Hello, I have a machine that seemed to reboot by itself yesterday, in /var/log/messages I only see: Mar 25 14:26:45 asterisk shutdown[19256]: shutting down for system reboot When I type: last reboot I see: reboot system boot 2.6.18-8.1.8.el5 Tue Mar 25 14:28 (18:41) So it seems like the kernel rebooted, but I'm not sure how I can track down why, any pointers? Thanks! Andrew
Andrew Hearn wrote:> Hello, > > I have a machine that seemed to reboot by itself yesterday, in > /var/log/messages I only see: > > Mar 25 14:26:45 asterisk shutdown[19256]: shutting down for system rebootWhat do you mean by "only see"? Are there no lines before this in /var/log/messages? Maybe in /var/log/messages.1 ? Mogens -- Mogens Kjaer, Carlsberg A/S, Computer Department Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark Phone: +45 33 27 53 25, Fax: +45 33 27 47 08 Email: mk at crc.dk Homepage: http://www.crc.dk
Check if you allow write access to snmp and from whom. A reboot request could have been issued via snmp. -Ross ----- Original Message ----- From: centos-bounces at centos.org <centos-bounces at centos.org> To: CentOS mailing list <centos at centos.org> Sent: Wed Mar 26 07:09:06 2008 Subject: Re: [CentOS] System Rebooted by 2.6.18-8.1.8.el5> This looks like a normal shutdown command was issued from somewhere, > IMO. I would check the other log files under /var/log and its sub- > directories for entries around this time. Especially secure.log*. Also, > I don't know your configuration, but is there a cron or at entry that > has a scheduled reboot? > >also check last log to see who was logged in _______________________________________________ CentOS mailing list CentOS at centos.org http://lists.centos.org/mailman/listinfo/centos ______________________________________________________________________ This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender and permanently delete the original and any copy or printout thereof. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.centos.org/pipermail/centos/attachments/20080326/4ccf5b46/attachment-0001.html>
> > Check if you allow write access to snmp and from whom. A reboot > request could have been issued via snmp. >it could but you'd need something to map the OID being hit to either a script or the reboot command
Andrew Hearn wrote:> Hello, > > I have a machine that seemed to reboot by itself yesterday, in > /var/log/messages I only see: > > Mar 25 14:26:45 asterisk shutdown[19256]: shutting down for system reboot > > When I type: last reboot > > I see: > > reboot system boot 2.6.18-8.1.8.el5 Tue Mar 25 14:28 (18:41) > > So it seems like the kernel rebooted, but I'm not sure how I can track > down why, any pointers? > > Thanks! > > > Andrew >Is there any chance someone could have hit the ctrl-alt-delete key combination on the console to trigger the reboot? I've had people do that inadvertently thinking they were on a Windows machine... -Greg
Greg Bailey wrote:> > Is there any chance someone could have hit the ctrl-alt-delete key > combination on the console to trigger the reboot? I've had people do > that inadvertently thinking they were on a Windows machine...After rebooting servers 3 or 4 times that way myself, I now disable this function in /etc/inittab on all of my servers. I don't see any point in allowing a hot-key to reboot a server. -- Bowie