system haltet

[Peter Roege]

hi

can any one please tell me where to find any logfiles if the system is being bought down if its haltet

Peter Røge SIEMENS Denmar

[Pete Randall]

/var/adm/syslog/syslog.log
/var/adm/shutdown.log
/etc/shutdownlog


Pete

[Chris Vail]

If the system has been stopped, it can't write any files. However, you can look at your syslog (generally /var/adm/syslog/syslog.log) to see when shutdown started. After its rebooted, the uptime command will tell you how long its been up.


Chris

[Robert-Jan Goossens_1]

Hi Peter,

If your system is halted to init 0 you can only login to the GSP and access the GSP "error" log using the GSP "SL" command.

Regards,
Robert-Jan

[A. Clay Stephenson]

/etc/shutdownlog

If OS crashed, look in /var/adm/crash

/var/adm/syslog/syslog.log

[Peter Roege]

hi

the message from root is the following:

system maintenace about to begin
all processes will be terminatet in 0 sec

broatcast message from root
SYSTEM BEING BOUGHT DOWN NOW !!!!

hope this help
regard peter

[melvyn burnard]

are you saying that this is what was seen and then the system went down?

If so, this is because someone wit the right permissions has issued the shutdown command
check /etc/shutdownlog you should see it in there.

[Peter Roege]

Yes is see this message on screen !!!

To your help i am running a INGRES server on the system

I will try looking at logfiles

Regards Peter

[Peter Roege]

Hi

The ony message in shutdownlog is:
HALT

Peter

[melvyn burnard]

why don't you post the last few lines of your shutdown log, and the OLDsyslog.log, as this may give a clue

[Rajiv Singhal]

your /etc/shutdownlog should say something like this ,

11:14 Mon Sep 20, 2004. Reboot: (by wc-w5!root)
11:55 Mon Sep 20, 2004. Reboot:
12:05 Mon Sep 20, 2004. Reboot:
13:03 Mon Sep 20, 2004. Reboot:
10:19 Tue Sep 21, 2004. Reboot:
11:34 Tue Oct 12, 2004. Halt:
13:13 Fri Nov 19, 2004. Halt:
14:43 Fri Nov 19, 2004. Halt: (by wc-w5!root)
15:26 Fri Jan 21, 2005. Reboot:

[Albert Smith_1]

Check your /etc/shutdownlog
check you /var/adm/syslog/syslog.log
check your /var/adm/syslog/OLDsyslog.log

If the system came down because of a panic it will be noted in the /etc/shutdownlog and there will be a recent ts99 file in:
/var/tombstones

and in most case's a crash file will be written out to:

/var/adm/crash

You can also do an: uptime or who to see how long the server has been up.

If the server didn't go down it is quite possible root could have walled it or someone was playing a prank to your terminal.
or the shutdown was aborted.

[B. Hulst]

Hi,

Just type the unix command last.

It will show you who logged in and when it rebooted cq. booted.

You might also have an idea who did it since
the host of the logged in user is also listed.

There is also lastb, for failed logins but not failed reboots. ;-)

- Bob

[Peter Roege]

Working on the problem now
Thanks to all for parcipitation

Regards Peter