Shutdown LOG

[Sampath_4]

My server is getting shutdown automatically .Shutdownlog doesnot show the user responsible for the shutdown. How do i know which user is responsible for the shutdown

Regards,
N.Sampath Kumar

[AwadheshPandey]

check ur file system first, if any file system is full, then sytem Goes down automaticaly.

check

#dmesg
for any error messages

Awadhesh

[Orhan Biyiklioglu]

Check /etc/shutdownlog file

hth

[Joseph Loo]

hi,

what is included in /etc/shutdown.allow, if it is blank, only the root user is allow to bring the system down.

regards.

[Sampath_4]

Thanks for your fast response

None of the filesystems are full.

/etc/shutdownlog shows only the timestamp of the shutdown but not the user responsible for the shutdown

[Sampath_4]

shutdown.allow is blank ,but i have some users with UID 0, whether they will be able to shutdown the machine

[RAC_1]

There might be different reason why server is getting shutdown. do you see anything in syslog.log, in /var/tombstones/ts99 or in dir /var/adm/crash??

Also do you any error with poer supplies. check it through GSP.

[RAC_1]

Anybody with uid 0 will be able to shutdown. But this would get logged in shutdownlog, unless some edited it.

It is a bad idea and sysadmin practice to have many accounts with uid. you can check such accounts with logins -d command.

[Sampath_4]

There is no /var/tomstones/ts99.

/var/adm/crash doesnt have any dump in the latest date.It is not to abrupt shutdown it is getting shutdown using the reboot command . When i moved the /sbin/reboot to some other name , i am getting sh: reboot not found error in my console.


How to check the power supplies ? How to access GSP

[AwadheshPandey]

uid 0 is reserve for root, this is a very bad practice to create such other ids with 0 ids, first change these ids with some other ids rather than system reserve ids ie 0-99,
if problem comes again then check any other issue.
syslog.log,
and /var/adm/crash for any new entry

Awadhesh

[Ranjith_5 · Accepted solution]

Hi Sampath,

** Is this a shutdown / reboot?

** Look at /var/adm/syslog/OLDsyslog.log for the reason for shutdown/reboot. syslog.log will be copied to OLDsyslog.log during boot time.

** if you are not able to find the reason of shutdown from shutdownlog please see the time of last boot and see the users who logged on to the system during that time.

try the command

#last -R|more

** Use STM to verify the system health is in safe condition.

Regards,
Syam

[Joseph Loo]

hi,

as the rest have suggested, not really good practice to have multiple UID 0, but since u have done that...

anyway, do u keep .sh_history file on each user, u may examine that file of those user with UID 0. however, that user may also have clear the "shutdown" command line if he/she is clearing his/her tracks.

regards.

[Sandman!]

Check the following files/folders:

/var/adm/syslog.log
/var/adm/syslog/OLDsyslog.log
/var/adm/crash/
/etc/shutdownlog
/var/tombstones/ts99

Look for cron jobs that may be causing reboots. Create wrapper scripts for the reboot and shutdown utilities so that you are notified by e-mail whenever they are called.

regards!

[Arunvijai_4]

Checking at /var/adm/syslog/syslog.log and revisiting any cronjobs running may also help you.

-Arun

[MarkSyder]

I suspect this is resolved as you've given a bunny, but just in case ...

Once you know what time the shutdown took place you can look in /var/adm/cron/log to see if any cron jobs ran immediately before.

MArk Syder (like the drink but spelt different)

[Sampath_4]

the problem seemed to be some user shutting the machine remotely . Since he is clearing all his tracks i couldnt able to trace the user.I have moved the shutdown and reboot files , then he used the init 0 . He got the tip , then he stopped doing it .Now i have wrapped the shutdown and reboot in to a script which will log the user information in some file so that i can trace him once he tries to do it again. thanks for all your valuable information.