the UNIX last command lists reboots and shutdowns from the command line. the RHEL last should do the same thing (IIRC, it does but we rarely use last on linux boxes). if it doesn't list anything, that means the shutdown/reboot was not caused by a command such as shutdown or reboot. this indicates a spontaneous shutdown caused by any number of things--power outage, drastic software or hardware problems, etc. this is what you asked for, isn't it. On Fri, Nov 12, 2010 at 8:24 AM, ESGLinux <esggrupos@xxxxxxxxx> wrote: > yes itÂs avaliable but I donÂt see anything about the shutdown :-( > > Greetings, > > ESG > > 2010/11/12 hike <mh1272@xxxxxxxxx> > > > isn't the last command still available in RHEL? > > > > > > On Fri, Nov 12, 2010 at 5:27 AM, ESGLinux <esggrupos@xxxxxxxxx> wrote: > > > > > Hi, > > > > > > I think something put the finger in the power, because I donÂt get any > > log > > > in messages or other file. > > > > > > Now IÂm going to investigate who has made that without telling nothing > > > :-((( > > > > > > Thanks > > > > > > ESG > > > > > > 2010/11/11 Dennis Comeaux <dennis.comeaux@xxxxxxxxx> > > > > > > > Have you tried /var/log/messages? I have notes in there about Kernel > > > > logging stopping when it goes down. If someone just gave the machine > > the > > > > finger (hit the power button and held it down so it went down without > > an > > > > ACPI poweroff call), then you won't have anything. I think it may > also > > > be > > > > recorded in /var/log/daemon.log on some installs. However WHO > > requested > > > it > > > > may or may not be. > > > > > > > > On Fri, Nov 5, 2010 at 5:05 AM, ESGLinux <esggrupos@xxxxxxxxx> > wrote: > > > > > > > > > Hi All, > > > > > > > > > > I have arrived today at work and I have found a RHEL 5 server > > poweroff. > > > > > > > > > > I want to know what has happened. So, I first want to know if > someone > > > has > > > > > executed shutdown/halt/poweroff or any other command that can power > > off > > > > the > > > > > machine, > > > > > > > > > > I have checked the messages file but I cant see nothing: > > > > > > > > > > Nov 4 12:24:34 www smartd[2097]: In the system's table of devices > NO > > > > > devices found to scan > > > > > Nov 4 12:24:34 www smartd[2097]: Monitoring 0 ATA and 0 SCSI > devices > > > > > Nov 4 12:24:34 www smartd[2099]: smartd has fork()ed into > background > > > > mode. > > > > > New PID=2099. > > > > > Nov 5 09:20:01 www syslogd 1.4.1: restart. > > > > > Nov 5 09:20:02 www kernel: klogd 1.4.1, log source = /proc/kmsg > > > started. > > > > > > > > > > at 09:20 I restart the machine. > > > > > > > > > > With the sar command I see this: > > > > > > > > > > 06:40:02 AM all 0.10 0.00 0.08 0.48 > > 0.01 > > > > > 99.33 > > > > > 06:50:01 AM all 0.11 0.00 0.07 0.36 > > 0.01 > > > > > 99.45 > > > > > 07:00:01 AM all 0.13 0.00 0.07 0.80 > > 0.01 > > > > > 98.98 > > > > > Average: all 0.12 0.00 0.07 0.80 > > 0.01 > > > > > 98.99 > > > > > > > > > > 09:19:48 AM LINUX RESTART > > > > > > > > > > 09:30:01 AM CPU %user %nice %system %iowait > > %steal > > > > > %idle > > > > > 09:40:01 AM all 0.60 0.00 0.11 5.57 > > 0.01 > > > > > 93.71 > > > > > > > > > > So between 07:00 and 07:10 the system goes down, but WHY??? > > > > > > > > > > with the ausearch command I get this: > > > > > > > > > > ---- > > > > > time->Fri Nov 5 07:01:01 2010 > > > > > type=CRED_ACQ msg=audit(1288936861.670:3707): user pid=9601 uid=0 > > > > > auid=4294967295 msg='PAM: setcred acct="root" : > exe="/usr/sbin/crond" > > > > > (hostname=?, addr=?, terminal=cron res=success)' > > > > > ---- > > > > > time->Fri Nov 5 07:01:01 2010 > > > > > type=LOGIN msg=audit(1288936861.670:3708): login pid=9601 uid=0 old > > > > > auid=4294967295 new auid=0 > > > > > ---- > > > > > time->Fri Nov 5 07:01:01 2010 > > > > > type=USER_START msg=audit(1288936861.720:3709): user pid=9601 uid=0 > > > > auid=0 > > > > > msg='PAM: session open acct="root" : exe="/usr/sbin/crond" > > (hostname=?, > > > > > addr=?, terminal=cron res=success)' > > > > > ---- > > > > > time->Fri Nov 5 07:01:01 2010 > > > > > type=CRED_DISP msg=audit(1288936861.730:3710): user pid=9601 uid=0 > > > auid=0 > > > > > msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, > > > > addr=?, > > > > > terminal=cron res=success)' > > > > > ---- > > > > > time->Fri Nov 5 07:01:01 2010 > > > > > type=USER_END msg=audit(1288936861.730:3711): user pid=9601 uid=0 > > > auid=0 > > > > > msg='PAM: session close acct="root" : exe="/usr/sbin/crond" > > > (hostname=?, > > > > > addr=?, terminal=cron res=success)' > > > > > ---- > > > > > time->Fri Nov 5 09:20:00 2010 > > > > > type=DAEMON_START msg=audit(1288945200.613:9651): auditd start, > > > > ver=1.7.17 > > > > > format=raw kernel=2.6.18.8-xen auid=4294967295 pid=1440 res=success > > > > > ---- > > > > > > > > > > If the systems goes down because of power failure or something > > strange, > > > > is > > > > > there any way to check it? > > > > > > > > > > Thanks in advance > > > > > > > > > > ESG > > > > > -- > > > > > redhat-list mailing list > > > > > unsubscribe mailto:redhat-list-request@xxxxxxxxxx > > ?subject=unsubscribe > > > > > https://www.redhat.com/mailman/listinfo/redhat-list > > > > > > > > > > > > > > > > > > > > > -- > > > > "il n'y a pas de libertà s'il y a dÃpendance" > > > > --Theobalt > > > > -- > > > > redhat-list mailing list > > > > unsubscribe mailto:redhat-list-request@xxxxxxxxxx > ?subject=unsubscribe > > > > https://www.redhat.com/mailman/listinfo/redhat-list > > > -- > > > redhat-list mailing list > > > unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe > > > https://www.redhat.com/mailman/listinfo/redhat-list > > > > > -- > > redhat-list mailing list > > unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe > > https://www.redhat.com/mailman/listinfo/redhat-list > > > -- > redhat-list mailing list > unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe > https://www.redhat.com/mailman/listinfo/redhat-list > -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list
