Who rebooted my server ? and why ?

itselango · 09-22-2004, 12:05 AM

Hi ,

My server was rebooted and i am unable to find who rebooted it, the only info i got was from last, which has the rebooted time. I also had a look into the /var/log/messages and it didn't have much info, it just said syslogd restarted.

Any pointers will be helpful.

Regards
Elango.

ps: now don't post here saying "I did".

korozion · 09-22-2004, 12:14 AM

How was the power situation. Maybe install and run chkrootkit. Also look into some security ideas. May be a good idea.

itselango · 09-22-2004, 12:19 AM

There wasn't any power problem..., even if it was a power problem.., when can get the message saying it was an abrupt shutdown .....and was not raised by any user..,will check on checkrootkit

Elango.

inimino · 09-22-2004, 02:47 AM

It could be a security issue, or an accidental reboot at the data center, or even a hardware fluke.

If it was a hard reboot you may or may not see something in the logs about filesystems not umounted properly.

TigerOC · 09-22-2004, 03:04 PM

I doubt anyone rebooted. I run an internet server which has an uptime of 3 months. The syslog is restarted each day at 6:25 through /etc/cron.daily so check that you don't have the same kind of entry.

m4dj4ck · 09-23-2004, 01:01 AM

it could be power trip problem. the servers im working on have the same problem as well. syslogd logged "syslogd restarted". After further investigation, it turned to be our UPS problem.