On Sat, Mar 04, 2006 at 10:24:17AM -0500, Jon Poland wrote: > > Hi, > I operate a colo box running FreeBSD 6.0-SECURITY. Yesterday the box > shutdown and powered off. I didn't execute shutdown or halt, and I'm the > only user who can. Here's what the logs tell me: > > /var/log/console.log: > Mar 3 11:24:29 kmart kernel: Shutting down daemon processes: > > /var/log/messages: > Mar 3 11:24:38 kmart syslogd: exiting on signal 15 > > last: (the important lines) > reboot ~ Fri Mar 3 13:10 > shutdown ~ Fri Mar 3 11:24 > > I don't see anything in any of the logs like "rebooted by X", etc. > > I'm not exactly sure how this can happen and looking for ideas. >
Where are you logging security messages? I believe the default is to /var/log/security Have a look at /etc/syslog.conf and syslog.conf(5) You should see messages such as this in your security log: Mar 1 15:21:38 srv1 shutdown: reboot by kdgrills: -- Kelly D. Grills [EMAIL PROTECTED]
pgpTjj9CYyMxk.pgp
Description: PGP signature
