how to check if shutdown/halt has been executed
Kyle O'Donnell
redhat at isprime.org
Thu Nov 18 02:15:04 UTC 2010
will 'last' tell you?
On Wed, 17 Nov 2010 21:04:58 -0500, Sanjay Chakraborty
<sanjaychakrab at gmail.com> wrote:
> It happens because some one might have run "poweroff". This command
> not let any output in any log file.
>
>
> On Fri, Nov 12, 2010 at 7:18 PM, hike <mh1272 at gmail.com> wrote:
>> the UNIX last command lists reboots and shutdowns from the command line.
>> the RHEL last should do the same thing (IIRC, it does but we rarely use last
>> on linux boxes).
>> if it doesn't list anything, that means the shutdown/reboot was not caused
>> by a command such as shutdown or reboot. this indicates a spontaneous
>> shutdown caused by any number of things--power outage, drastic software or
>> hardware problems, etc.
>> this is what you asked for, isn't it.
>>
>>
>>
>> On Fri, Nov 12, 2010 at 8:24 AM, ESGLinux <esggrupos at gmail.com> wrote:
>>
>>> yes it´s avaliable but I don´t see anything about the shutdown :-(
>>>
>>> Greetings,
>>>
>>> ESG
>>>
>>> 2010/11/12 hike <mh1272 at gmail.com>
>>>
>>> > isn't the last command still available in RHEL?
>>> >
>>> >
>>> > On Fri, Nov 12, 2010 at 5:27 AM, ESGLinux <esggrupos at gmail.com> wrote:
>>> >
>>> > > Hi,
>>> > >
>>> > > I think something put the finger in the power, because I don´t get any
>>> > log
>>> > > in messages or other file.
>>> > >
>>> > > Now I´m going to investigate who has made that without telling nothing
>>> > > :-(((
>>> > >
>>> > > Thanks
>>> > >
>>> > > ESG
>>> > >
>>> > > 2010/11/11 Dennis Comeaux <dennis.comeaux at gmail.com>
>>> > >
>>> > > > Have you tried /var/log/messages? I have notes in there about Kernel
>>> > > > logging stopping when it goes down. If someone just gave the machine
>>> > the
>>> > > > finger (hit the power button and held it down so it went down without
>>> > an
>>> > > > ACPI poweroff call), then you won't have anything. I think it may
>>> also
>>> > > be
>>> > > > recorded in /var/log/daemon.log on some installs. However WHO
>>> > requested
>>> > > it
>>> > > > may or may not be.
>>> > > >
>>> > > > On Fri, Nov 5, 2010 at 5:05 AM, ESGLinux <esggrupos at gmail.com>
>>> wrote:
>>> > > >
>>> > > > > Hi All,
>>> > > > >
>>> > > > > I have arrived today at work and I have found a RHEL 5 server
>>> > poweroff.
>>> > > > >
>>> > > > > I want to know what has happened. So, I first want to know if
>>> someone
>>> > > has
>>> > > > > executed shutdown/halt/poweroff or any other command that can power
>>> > off
>>> > > > the
>>> > > > > machine,
>>> > > > >
>>> > > > > I have checked the messages file but I cant see nothing:
>>> > > > >
>>> > > > > Nov 4 12:24:34 www smartd[2097]: In the system's table of devices
>>> NO
>>> > > > > devices found to scan
>>> > > > > Nov 4 12:24:34 www smartd[2097]: Monitoring 0 ATA and 0 SCSI
>>> devices
>>> > > > > Nov 4 12:24:34 www smartd[2099]: smartd has fork()ed into
>>> background
>>> > > > mode.
>>> > > > > New PID=2099.
>>> > > > > Nov 5 09:20:01 www syslogd 1.4.1: restart.
>>> > > > > Nov 5 09:20:02 www kernel: klogd 1.4.1, log source = /proc/kmsg
>>> > > started.
>>> > > > >
>>> > > > > at 09:20 I restart the machine.
>>> > > > >
>>> > > > > With the sar command I see this:
>>> > > > >
>>> > > > > 06:40:02 AM all 0.10 0.00 0.08 0.48
>>> > 0.01
>>> > > > > 99.33
>>> > > > > 06:50:01 AM all 0.11 0.00 0.07 0.36
>>> > 0.01
>>> > > > > 99.45
>>> > > > > 07:00:01 AM all 0.13 0.00 0.07 0.80
>>> > 0.01
>>> > > > > 98.98
>>> > > > > Average: all 0.12 0.00 0.07 0.80
>>> > 0.01
>>> > > > > 98.99
>>> > > > >
>>> > > > > 09:19:48 AM LINUX RESTART
>>> > > > >
>>> > > > > 09:30:01 AM CPU %user %nice %system %iowait
>>> > %steal
>>> > > > > %idle
>>> > > > > 09:40:01 AM all 0.60 0.00 0.11 5.57
>>> > 0.01
>>> > > > > 93.71
>>> > > > >
>>> > > > > So between 07:00 and 07:10 the system goes down, but WHY???
>>> > > > >
>>> > > > > with the ausearch command I get this:
>>> > > > >
>>> > > > > ----
>>> > > > > time->Fri Nov 5 07:01:01 2010
>>> > > > > type=CRED_ACQ msg=audit(1288936861.670:3707): user pid=9601 uid=0
>>> > > > > auid=4294967295 msg='PAM: setcred acct="root" :
>>> exe="/usr/sbin/crond"
>>> > > > > (hostname=?, addr=?, terminal=cron res=success)'
>>> > > > > ----
>>> > > > > time->Fri Nov 5 07:01:01 2010
>>> > > > > type=LOGIN msg=audit(1288936861.670:3708): login pid=9601 uid=0 old
>>> > > > > auid=4294967295 new auid=0
>>> > > > > ----
>>> > > > > time->Fri Nov 5 07:01:01 2010
>>> > > > > type=USER_START msg=audit(1288936861.720:3709): user pid=9601 uid=0
>>> > > > auid=0
>>> > > > > msg='PAM: session open acct="root" : exe="/usr/sbin/crond"
>>> > (hostname=?,
>>> > > > > addr=?, terminal=cron res=success)'
>>> > > > > ----
>>> > > > > time->Fri Nov 5 07:01:01 2010
>>> > > > > type=CRED_DISP msg=audit(1288936861.730:3710): user pid=9601 uid=0
>>> > > auid=0
>>> > > > > msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?,
>>> > > > addr=?,
>>> > > > > terminal=cron res=success)'
>>> > > > > ----
>>> > > > > time->Fri Nov 5 07:01:01 2010
>>> > > > > type=USER_END msg=audit(1288936861.730:3711): user pid=9601 uid=0
>>> > > auid=0
>>> > > > > msg='PAM: session close acct="root" : exe="/usr/sbin/crond"
>>> > > (hostname=?,
>>> > > > > addr=?, terminal=cron res=success)'
>>> > > > > ----
>>> > > > > time->Fri Nov 5 09:20:00 2010
>>> > > > > type=DAEMON_START msg=audit(1288945200.613:9651): auditd start,
>>> > > > ver=1.7.17
>>> > > > > format=raw kernel=2.6.18.8-xen auid=4294967295 pid=1440 res=success
>>> > > > > ----
>>> > > > >
>>> > > > > If the systems goes down because of power failure or something
>>> > strange,
>>> > > > is
>>> > > > > there any way to check it?
>>> > > > >
>>> > > > > Thanks in advance
>>> > > > >
>>> > > > > ESG
>>> > > > > --
>>> > > > > redhat-list mailing list
>>> > > > > unsubscribe mailto:redhat-list-request at redhat.com
>>> > ?subject=unsubscribe
>>> > > > > https://www.redhat.com/mailman/listinfo/redhat-list
>>> > > > >
>>> > > >
>>> > > >
>>> > > >
>>> > > > --
>>> > > > "il n'y a pas de liberté s'il y a dépendance"
>>> > > > --Theobalt
>>> > > > --
>>> > > > redhat-list mailing list
>>> > > > unsubscribe mailto:redhat-list-request at redhat.com
>>> ?subject=unsubscribe
>>> > > > https://www.redhat.com/mailman/listinfo/redhat-list
>>> > > --
>>> > > redhat-list mailing list
>>> > > unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
>>> > > https://www.redhat.com/mailman/listinfo/redhat-list
>>> > >
>>> > --
>>> > redhat-list mailing list
>>> > unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
>>> > https://www.redhat.com/mailman/listinfo/redhat-list
>>> >
>>> --
>>> redhat-list mailing list
>>> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
>>> https://www.redhat.com/mailman/listinfo/redhat-list
>>>
>> --
>> redhat-list mailing list
>> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
>> https://www.redhat.com/mailman/listinfo/redhat-list
>
>
>
> --
> Regards.
> Sanjay Chakraborty
More information about the redhat-list
mailing list