Finding how the machine was rebooted

[Ion-Mihai Tetcu]

On Fri, 9 Apr 2004 17:15:39 -0500
Hari Bhaskaran <subscr at spider.netmails.net> wrote:

> Hi,
> 
> I am trying to trouble shoot a problem where one of the machines
> got rebooted. I can see "last" shows a shutdown was done. How
> do I know if it was a Cntrl-Alt-Del done from the console or
> if it was a shutdown command executed via a ssh/remote login?

ssh (third column is the remote host):
itetcu           ttyp0    it.buh           Tue Apr  6 09:06 - 18:23 (3+09:17)
reboot           ~                         Tue Apr  6 08:56
shutdown         ~                         Tue Apr  6 08:54
itetcu           ttyp2    it.buh           Tue Apr  6 08:51 - shutdown (00:02)

console:
root             ttyv1                     Fri Apr  9 18:44 - 18:48 (00:04)
reboot           ~                         Fri Apr  9 18:44
shutdown         ~                         Fri Apr  9 18:43
root             ttyv1                     Fri Apr  9 18:41 - shutdown (00:01)

> I would also like to know if it was some panic/bug etc also.

You wouldn't get the last -shutdown line. You probably would have
something in the logs.
 
> Also I have a dmesg.today that is couple of days older than
> /var/run/dmesg.boot. How is that possible? Doesn't dmesg.today
> mean the the dmesg of the last (current) boot?

itetcu at it> /usr/local/etc/postfix [1:58:33] 0
 # ll /var/log/dmesg.* /var/run/dmesg.boot
-rw-------  1 root  wheel  13784 Apr  9 03:08 /var/log/dmesg.today
-rw-------  1 root  wheel  13600 Apr  8 03:06 /var/log/dmesg.yesterday
-rw-r--r--  1 root  wheel  21713 Apr  9 18:43 /var/run/dmesg.boot
itetcu at it> /usr/local/etc/postfix [1:58:34] 0
 # uptime
 1:58AM  up  7:15, 2 users, load averages: 0.02, 0.18, 0.25

> BTW, /var/ is running on a vinum-ed partition (if that would 
> help) 

Shouldn't mater.


-- 
IOnut
Unregistered ;) FreeBSD "user"