last -x output

lunaticMonk · 02-04-2014, 05:45 PM

I'm trying to figure out if someone is tampering with my laptop at night. i am reading the last -x output and there are reboot entries at hours my office is supposed to be locked. i've added a typical block of output. the change to level 5 I assume is x windows system starting, shutdown is self explanatory. reboot at those odd hours I don't understand.

Code:

runlevel (to lvl 5)   3.12.8-300.fc20. Sun Feb  2 13:06 - 18:48  (05:41)
reboot   system boot  3.12.8-300.fc20. Sun Feb  2 05:05 - 18:48  (13:42)
reboot   system boot  3.12.8-300.fc20. Sun Feb  2 05:05 - 18:48  (13:42)
shutdown system down  3.12.8-300.fc20. Sun Feb  2 12:37 - 05:05  (-7:-31)
user     :0           :0               Sun Feb  2 11:05 - 12:37  (01:32)
(unknown :0           :0               Sun Feb  2 11:04 - 11:05  (00:00)
runlevel (to lvl 5)   3.12.8-300.fc20. Sun Feb  2 11:04 - 12:37  (01:32)
reboot   system boot  3.12.8-300.fc20. Sun Feb  2 03:04 - 12:37  (09:33)
reboot   system boot  3.12.8-300.fc20. Sun Feb  2 03:04 - 12:37  (09:33)
shutdown system down  3.12.8-300.fc20. Sat Feb  1 19:03 - 03:04  (08:01)

unSpawn · 02-04-2014, 06:03 PM

Quote:

Originally Posted by lunaticMonk

Code:

user     :0           :0               Sun Feb  2 11:05 - 12:37  (01:32)
(unknown :0           :0               Sun Feb  2 11:04 - 11:05  (00:00)

"(unknown"? Interesting. Are unprivileged users allowed to reboot the machine? Can you look at other logs too like cron or at jobs logging, /var/log/secure, /var/log/messages, any (networked?) services before and up to the login time? Users shell history files? MAC times of files before and up to the login time?

John VV · 02-04-2014, 06:30 PM

are you really turning it off ?
or is it hibernating

if not a full shutdown cron can be powering it up at 24:00
midnight is a normal time

lunaticMonk · 02-04-2014, 08:52 PM

I believe It's a full shutdown. It's Fedora 20 with luks disk encryption. I have to mount the disk when I power up so I assume it shutdown correctly.
I ran journalctl for 05:59 this morning when I was shaving this is what I got:

http://ubuntuone.com/5mvqWBtt7MiDfPRfTJOBWE

I don't really know what I'm looking for.

John VV · 02-04-2014, 09:02 PM

Quote:

I have to mount the disk when I power up

what ??????

is this a dual boot using an external drive ?
or are you booting from a usb thumb drive on a MS windows computer ?

lunaticMonk · 02-05-2014, 08:37 AM

What I meant was it boots like it was a complete shutdown. the boot menu gives me the option to boot Linux or Windows then I enter my luks password. no external drive.

John VV · 02-05-2014, 11:39 AM

so it is a dual boot with windows

is auto update set to auto wake up the machine at 24:00 and look for updates ?
( default i think )

Quote:

I have to mount the disk when I power up

the confusion is you described a boot from a EXTERNAL drive
and not a dual boot that you have

you are only selecting a os to boot
not mounting a drive MANUALLY at boot .

lunaticMonk · 02-05-2014, 05:05 PM

I turned off the updates plugin I'll check tomorrow.

John VV · 02-05-2014, 07:09 PM

also turn off the microsoft " auto update"