how to check if shutdown/halt has been executed

hike mh1272 at gmail.com
Sat Nov 13 00:18:27 UTC 2010 

the UNIX last command lists reboots and shutdowns from the command line.
the RHEL last should do the same thing (IIRC, it does but we rarely use last
on linux boxes).
if it doesn't list anything, that means the shutdown/reboot was not caused
by a command such as shutdown or reboot.  this indicates a spontaneous
shutdown caused by any number of things--power outage, drastic software or
hardware problems, etc.
this is what you asked for, isn't it.



On Fri, Nov 12, 2010 at 8:24 AM, ESGLinux <esggrupos at gmail.com> wrote:

> yes it´s avaliable but I don´t see anything about the shutdown :-(
>
> Greetings,
>
> ESG
>
> 2010/11/12 hike <mh1272 at gmail.com>
>
> > isn't the last command still available in RHEL?
> >
> >
> > On Fri, Nov 12, 2010 at 5:27 AM, ESGLinux <esggrupos at gmail.com> wrote:
> >
> > > Hi,
> > >
> > > I think something put the finger in the power, because  I don´t get any
> > log
> > > in messages or other file.
> > >
> > > Now I´m going to investigate who has made that without telling nothing
> > > :-(((
> > >
> > > Thanks
> > >
> > > ESG
> > >
> > > 2010/11/11 Dennis Comeaux <dennis.comeaux at gmail.com>
> > >
> > > > Have you tried /var/log/messages?  I have notes in there about Kernel
> > > > logging stopping when it goes down.  If someone just gave the machine
> > the
> > > > finger (hit the power button and held it down so it went down without
> > an
> > > > ACPI poweroff call), then you won't have anything.  I think it may
> also
> > > be
> > > > recorded in /var/log/daemon.log on some installs.  However WHO
> > requested
> > > it
> > > > may or may not be.
> > > >
> > > > On Fri, Nov 5, 2010 at 5:05 AM, ESGLinux <esggrupos at gmail.com>
> wrote:
> > > >
> > > > > Hi All,
> > > > >
> > > > > I have arrived today at work and I have found a RHEL 5 server
> > poweroff.
> > > > >
> > > > > I want to know what has happened. So, I first want to know if
> someone
> > > has
> > > > > executed shutdown/halt/poweroff or any other command that can power
> > off
> > > > the
> > > > > machine,
> > > > >
> > > > > I have checked the messages file but I cant see nothing:
> > > > >
> > > > > Nov  4 12:24:34 www smartd[2097]: In the system's table of devices
> NO
> > > > > devices found to scan
> > > > > Nov  4 12:24:34 www smartd[2097]: Monitoring 0 ATA and 0 SCSI
> devices
> > > > > Nov  4 12:24:34 www smartd[2099]: smartd has fork()ed into
> background
> > > > mode.
> > > > > New PID=2099.
> > > > > Nov  5 09:20:01 www syslogd 1.4.1: restart.
> > > > > Nov  5 09:20:02 www kernel: klogd 1.4.1, log source = /proc/kmsg
> > > started.
> > > > >
> > > > > at 09:20 I restart the machine.
> > > > >
> > > > > With the sar command I see this:
> > > > >
> > > > > 06:40:02 AM       all      0.10      0.00      0.08      0.48
> >  0.01
> > > > > 99.33
> > > > > 06:50:01 AM       all      0.11      0.00      0.07      0.36
> >  0.01
> > > > > 99.45
> > > > > 07:00:01 AM       all      0.13      0.00      0.07      0.80
> >  0.01
> > > > > 98.98
> > > > > Average:          all      0.12      0.00      0.07      0.80
> >  0.01
> > > > > 98.99
> > > > >
> > > > > 09:19:48 AM       LINUX RESTART
> > > > >
> > > > > 09:30:01 AM       CPU     %user     %nice   %system   %iowait
> >  %steal
> > > > > %idle
> > > > > 09:40:01 AM       all      0.60      0.00      0.11      5.57
> >  0.01
> > > > > 93.71
> > > > >
> > > > > So between 07:00 and 07:10 the system  goes down, but WHY???
> > > > >
> > > > > with the ausearch command I get this:
> > > > >
> > > > > ----
> > > > > time->Fri Nov  5 07:01:01 2010
> > > > > type=CRED_ACQ msg=audit(1288936861.670:3707): user pid=9601 uid=0
> > > > > auid=4294967295 msg='PAM: setcred acct="root" :
> exe="/usr/sbin/crond"
> > > > > (hostname=?, addr=?, terminal=cron res=success)'
> > > > > ----
> > > > > time->Fri Nov  5 07:01:01 2010
> > > > > type=LOGIN msg=audit(1288936861.670:3708): login pid=9601 uid=0 old
> > > > > auid=4294967295 new auid=0
> > > > > ----
> > > > > time->Fri Nov  5 07:01:01 2010
> > > > > type=USER_START msg=audit(1288936861.720:3709): user pid=9601 uid=0
> > > > auid=0
> > > > > msg='PAM: session open acct="root" : exe="/usr/sbin/crond"
> > (hostname=?,
> > > > > addr=?, terminal=cron res=success)'
> > > > > ----
> > > > > time->Fri Nov  5 07:01:01 2010
> > > > > type=CRED_DISP msg=audit(1288936861.730:3710): user pid=9601 uid=0
> > > auid=0
> > > > > msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?,
> > > > addr=?,
> > > > > terminal=cron res=success)'
> > > > > ----
> > > > > time->Fri Nov  5 07:01:01 2010
> > > > > type=USER_END msg=audit(1288936861.730:3711): user pid=9601 uid=0
> > > auid=0
> > > > > msg='PAM: session close acct="root" : exe="/usr/sbin/crond"
> > > (hostname=?,
> > > > > addr=?, terminal=cron res=success)'
> > > > > ----
> > > > > time->Fri Nov  5 09:20:00 2010
> > > > > type=DAEMON_START msg=audit(1288945200.613:9651): auditd start,
> > > > ver=1.7.17
> > > > > format=raw kernel=2.6.18.8-xen auid=4294967295 pid=1440 res=success
> > > > > ----
> > > > >
> > > > > If the systems goes down because of power failure or something
> > strange,
> > > > is
> > > > > there any way to check it?
> > > > >
> > > > > Thanks in advance
> > > > >
> > > > > ESG
> > > > > --
> > > > > redhat-list mailing list
> > > > > unsubscribe mailto:redhat-list-request at redhat.com
> > ?subject=unsubscribe
> > > > > https://www.redhat.com/mailman/listinfo/redhat-list
> > > > >
> > > >
> > > >
> > > >
> > > > --
> > > > "il n'y a pas de liberté s'il y a dépendance"
> > > >   --Theobalt
> > > > --
> > > > redhat-list mailing list
> > > > unsubscribe mailto:redhat-list-request at redhat.com
> ?subject=unsubscribe
> > > > https://www.redhat.com/mailman/listinfo/redhat-list
> > > --
> > > redhat-list mailing list
> > > unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> > > https://www.redhat.com/mailman/listinfo/redhat-list
> > >
> > --
> > redhat-list mailing list
> > unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> > https://www.redhat.com/mailman/listinfo/redhat-list
> >
> --
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list
>

More information about the redhat-list mailing list