will 'last' tell you? On Wed, 17 Nov 2010 21:04:58 -0500, Sanjay Chakraborty <sanjaychakrab@xxxxxxxxx> wrote: > It happens because some one might have run "poweroff". This command > not let any output in any log file. > > > On Fri, Nov 12, 2010 at 7:18 PM, hike <mh1272@xxxxxxxxx> wrote: >> the UNIX last command lists reboots and shutdowns from the command line. >> the RHEL last should do the same thing (IIRC, it does but we rarely use last >> on linux boxes). >> if it doesn't list anything, that means the shutdown/reboot was not caused >> by a command such as shutdown or reboot. Âthis indicates a spontaneous >> shutdown caused by any number of things--power outage, drastic software or >> hardware problems, etc. >> this is what you asked for, isn't it. >> >> >> >> On Fri, Nov 12, 2010 at 8:24 AM, ESGLinux <esggrupos@xxxxxxxxx> wrote: >> >>> yes itÂs avaliable but I donÂt see anything about the shutdown :-( >>> >>> Greetings, >>> >>> ESG >>> >>> 2010/11/12 hike <mh1272@xxxxxxxxx> >>> >>> > isn't the last command still available in RHEL? >>> > >>> > >>> > On Fri, Nov 12, 2010 at 5:27 AM, ESGLinux <esggrupos@xxxxxxxxx> wrote: >>> > >>> > > Hi, >>> > > >>> > > I think something put the finger in the power, because ÂI donÂt get any >>> > log >>> > > in messages or other file. >>> > > >>> > > Now IÂm going to investigate who has made that without telling nothing >>> > > :-((( >>> > > >>> > > Thanks >>> > > >>> > > ESG >>> > > >>> > > 2010/11/11 Dennis Comeaux <dennis.comeaux@xxxxxxxxx> >>> > > >>> > > > Have you tried /var/log/messages? ÂI have notes in there about Kernel >>> > > > logging stopping when it goes down. ÂIf someone just gave the machine >>> > the >>> > > > finger (hit the power button and held it down so it went down without >>> > an >>> > > > ACPI poweroff call), then you won't have anything. ÂI think it may >>> also >>> > > be >>> > > > recorded in /var/log/daemon.log on some installs. ÂHowever WHO >>> > requested >>> > > it >>> > > > may or may not be. >>> > > > >>> > > > On Fri, Nov 5, 2010 at 5:05 AM, ESGLinux <esggrupos@xxxxxxxxx> >>> wrote: >>> > > > >>> > > > > Hi All, >>> > > > > >>> > > > > I have arrived today at work and I have found a RHEL 5 server >>> > poweroff. >>> > > > > >>> > > > > I want to know what has happened. So, I first want to know if >>> someone >>> > > has >>> > > > > executed shutdown/halt/poweroff or any other command that can power >>> > off >>> > > > the >>> > > > > machine, >>> > > > > >>> > > > > I have checked the messages file but I cant see nothing: >>> > > > > >>> > > > > Nov Â4 12:24:34 www smartd[2097]: In the system's table of devices >>> NO >>> > > > > devices found to scan >>> > > > > Nov Â4 12:24:34 www smartd[2097]: Monitoring 0 ATA and 0 SCSI >>> devices >>> > > > > Nov Â4 12:24:34 www smartd[2099]: smartd has fork()ed into >>> background >>> > > > mode. >>> > > > > New PID=2099. >>> > > > > Nov Â5 09:20:01 www syslogd 1.4.1: restart. >>> > > > > Nov Â5 09:20:02 www kernel: klogd 1.4.1, log source = /proc/kmsg >>> > > started. >>> > > > > >>> > > > > at 09:20 I restart the machine. >>> > > > > >>> > > > > With the sar command I see this: >>> > > > > >>> > > > > 06:40:02 AM    all   Â0.10   Â0.00   Â0.08   Â0.48 >>> > Â0.01 >>> > > > > 99.33 >>> > > > > 06:50:01 AM    all   Â0.11   Â0.00   Â0.07   Â0.36 >>> > Â0.01 >>> > > > > 99.45 >>> > > > > 07:00:01 AM    all   Â0.13   Â0.00   Â0.07   Â0.80 >>> > Â0.01 >>> > > > > 98.98 >>> > > > > Average:     Âall   Â0.12   Â0.00   Â0.07   Â0.80 >>> > Â0.01 >>> > > > > 98.99 >>> > > > > >>> > > > > 09:19:48 AM    LINUX RESTART >>> > > > > >>> > > > > 09:30:01 AM    CPU   %user   %nice  %system  %iowait >>> > Â%steal >>> > > > > %idle >>> > > > > 09:40:01 AM    all   Â0.60   Â0.00   Â0.11   Â5.57 >>> > Â0.01 >>> > > > > 93.71 >>> > > > > >>> > > > > So between 07:00 and 07:10 the system Âgoes down, but WHY??? >>> > > > > >>> > > > > with the ausearch command I get this: >>> > > > > >>> > > > > ---- >>> > > > > time->Fri Nov Â5 07:01:01 2010 >>> > > > > type=CRED_ACQ msg=audit(1288936861.670:3707): user pid=9601 uid=0 >>> > > > > auid=4294967295 msg='PAM: setcred acct="root" : >>> exe="/usr/sbin/crond" >>> > > > > (hostname=?, addr=?, terminal=cron res=success)' >>> > > > > ---- >>> > > > > time->Fri Nov Â5 07:01:01 2010 >>> > > > > type=LOGIN msg=audit(1288936861.670:3708): login pid=9601 uid=0 old >>> > > > > auid=4294967295 new auid=0 >>> > > > > ---- >>> > > > > time->Fri Nov Â5 07:01:01 2010 >>> > > > > type=USER_START msg=audit(1288936861.720:3709): user pid=9601 uid=0 >>> > > > auid=0 >>> > > > > msg='PAM: session open acct="root" : exe="/usr/sbin/crond" >>> > (hostname=?, >>> > > > > addr=?, terminal=cron res=success)' >>> > > > > ---- >>> > > > > time->Fri Nov Â5 07:01:01 2010 >>> > > > > type=CRED_DISP msg=audit(1288936861.730:3710): user pid=9601 uid=0 >>> > > auid=0 >>> > > > > msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, >>> > > > addr=?, >>> > > > > terminal=cron res=success)' >>> > > > > ---- >>> > > > > time->Fri Nov Â5 07:01:01 2010 >>> > > > > type=USER_END msg=audit(1288936861.730:3711): user pid=9601 uid=0 >>> > > auid=0 >>> > > > > msg='PAM: session close acct="root" : exe="/usr/sbin/crond" >>> > > (hostname=?, >>> > > > > addr=?, terminal=cron res=success)' >>> > > > > ---- >>> > > > > time->Fri Nov Â5 09:20:00 2010 >>> > > > > type=DAEMON_START msg=audit(1288945200.613:9651): auditd start, >>> > > > ver=1.7.17 >>> > > > > format=raw kernel=2.6.18.8-xen auid=4294967295 pid=1440 res=success >>> > > > > ---- >>> > > > > >>> > > > > If the systems goes down because of power failure or something >>> > strange, >>> > > > is >>> > > > > there any way to check it? >>> > > > > >>> > > > > Thanks in advance >>> > > > > >>> > > > > ESG >>> > > > > -- >>> > > > > redhat-list mailing list >>> > > > > unsubscribe mailto:redhat-list-request@xxxxxxxxxx >>> > ?subject=unsubscribe >>> > > > > https://www.redhat.com/mailman/listinfo/redhat-list >>> > > > > >>> > > > >>> > > > >>> > > > >>> > > > -- >>> > > > "il n'y a pas de libertà s'il y a dÃpendance" >>> > > >  --Theobalt >>> > > > -- >>> > > > redhat-list mailing list >>> > > > unsubscribe mailto:redhat-list-request@xxxxxxxxxx >>> ?subject=unsubscribe >>> > > > https://www.redhat.com/mailman/listinfo/redhat-list >>> > > -- >>> > > redhat-list mailing list >>> > > unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe >>> > > https://www.redhat.com/mailman/listinfo/redhat-list >>> > > >>> > -- >>> > redhat-list mailing list >>> > unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe >>> > https://www.redhat.com/mailman/listinfo/redhat-list >>> > >>> -- >>> redhat-list mailing list >>> unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe >>> https://www.redhat.com/mailman/listinfo/redhat-list >>> >> -- >> redhat-list mailing list >> unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe >> https://www.redhat.com/mailman/listinfo/redhat-list > > > > -- > Regards. > Sanjay Chakraborty -- redhat-list mailing list unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list
