Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: How to identify who rebooted the linux server
Top Forums UNIX for Dummies Questions & Answers How to identify who rebooted the linux server Post 302072856 by amro1 on Monday 8th of May 2006 09:16:25 AM
Old 05-08-2006
here...
The availability of details is depended on the syslog's settings, but in any case you can do following:

1. Get the boot time. You can get it by couple of ways, as you can type "uptime" commands and count back for how long it was on, or you can go to
/var/log and see the boot.log file, or in the same directory see "messages" file and look for "syslog started" time stamp.

2. type "last" command and see who were the uses logged in at the time when system had been rebooted

3. See these users shell history files in ~username/.bash_history for su or sudo commands.

All the aforesaid makes sense ONLY if you have proper access to root account and no one but root user knows the root's password. If you guys share the root password it is almost impossible to find who had rebooted the system. The only chance if you had systlog set to record network events. You can see in /var/log, messages and security logs for connections with a time-stamp kept alive around the reboot. Given your DHCP is long leasing or static IPs were used/or logs entries resolve DNS you can get the list of suspects. Then you proceed to step 3.

Have in mind that if someone INTENTIONALLY reboot the system and had complete root access and posses some skills, it is not only impossible to track, he/she may forge logs in any desirable way.

DO NOT SHARE ROOT ACCESS! USE "SUDO" TO PROTECT ROOT ACCOUNT!
 

9 More Discussions You Might Find Interesting

1. Solaris

server rebooted by user

Hi, how can i know who has rebooted the server? even last command is not displaying the user, wheather any way to track the user. (2 Replies)
Discussion started by: manoj.solaris
2 Replies

2. HP-UX

How can we know that the server was rebooted by which user in hp unix

Hi , Plz some one can help me ... How can we know that the server was rebooted by which user in hp unix and linux. Regards Venkata Jeevan (1 Reply)
Discussion started by: jeevanbv
1 Replies

3. AIX

server rebooted

Hi, I want to know how to find out which user has rebooted the server? I have used last command but it is not giving username though it is showing below output reboot --------------- date Regards, Manoj (5 Replies)
Discussion started by: manoj.solaris
5 Replies

4. Solaris

How to check when a solaris server got rebooted

In Windows we can check the event viewer for entries 6005,6006,6009 to confirm the system down times, as in when it got down and when it came back up. Is there some similar log files in Solaris/RHEL that I can check the timings and who or what caused the system reboot. I am an absolute newbie. Need... (4 Replies)
Discussion started by: lubu
4 Replies

5. Red Hat

Production unexpectedly server rebooted

I am trying to figure out what might causing Production server unexpectedly reboot during last few months .. Is auto reboot is set , I can check it is not set during the kernel panic but are they any other parameters which I am missing . -bash-2.05b$ uname -a Linux PD1011... (4 Replies)
Discussion started by: dba1981
4 Replies

6. Shell Programming and Scripting

Identify CPU usage on the Linux server

We are using linux server. We have below script running on the crontab and it send the alert if the cpu usage is above 90%. My question is, the below script tells the CPU usage for one CPU or all CPU in the server? sar 1 1 | sed '$!d' | awk '{printf("%d", $8)}' > $SAR_LOG Please let me... (4 Replies)
Discussion started by: govindts
4 Replies

7. Red Hat

Server uptime is showing 0hr but server not rebooted

Hi One of our server is showing the uptime 0hr 5mints there is no log in /var/log/messages there is no log in command "last" kernel version is 2.4.9 (RH2.1 AS) What could be the reason for this. is this issue is related to uptime counter reached max how to verify this. Best Regards KVK (4 Replies)
Discussion started by: venikathir
4 Replies

8. Red Hat

Server rebooted.

Hi, Yesterday one of Red Hat Server 4.2 got rebooted. I have checked /var/log/messages, but does not find out any serious issue related to peformance / hardware issue. how to find out why server was rebooted? (1 Reply)
Discussion started by: manoj.solaris
1 Replies

9. UNIX for Dummies Questions & Answers

AIX mount goes away if server rebooted

I have been mounting a directory to share with a windows pc. If i reboot the AIX box the mount goes away. How can i make the mount permanent? Here is the command I use to make the mount exportfs -i -o root=<servername> /path (1 Reply)
Discussion started by: fierfek
1 Replies

LEARN ABOUT PHP

statd

statd(1M)						  System Administration Commands						 statd(1M)

NAME

       statd - network status monitor

SYNOPSIS

       /usr/lib/nfs/statd

DESCRIPTION

       statd  is  an  intermediate  version of the status monitor. It interacts with lockd(1M) to provide the crash and recovery functions for the
       locking services on NFS. statd keeps track of the clients with processes which hold locks on a server. When  the  server  reboots  after  a
       crash,  statd  sends  a message to the statd on each client indicating that the server has rebooted. The client statd processes then inform
       the lockd on the client that the server has rebooted. The client lockd then attempts to reclaim the lock(s) from the server.

       statd on the client host also informs the statd on the server(s) holding locks for the client when the client has rebooted. In  this  case,
       the  statd on the server informs its lockd that all locks held by the rebooting client should be released, allowing other processes to lock
       those files.

       lockd is started by automountd(1M), mount_nfs(1M), and share(1M) if NFS automounts are needed.

FILES

       /var/statmon/sm			       lists hosts and network addresses to be contacted after a reboot

       /var/statmon/sm.bak		       lists hosts and network addresses that could not be contacted after last reboot

       /var/statmon/state		       includes a number which changes during a reboot

       /usr/include/rpcsvc/sm_inter.x	       contains the rpcgen source code for the interface services provided by the statd daemon.

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUNWnfscu 		   |
       +-----------------------------+-----------------------------+

SEE ALSO

       svcs(1), automountd(1M), lockd(1M), mount_nfs(1M), share(1M), svcadm(1M), attributes(5), smf(5)

       System Administration Guide: IP Services

NOTES

       The crash of a server is only detected upon its recovery.

       The statd service is managed by the service management facility, smf(5), under the service identifier:

       svc:/network/nfs/status

       Administrative actions on this service, such as enabling, disabling, or requesting restart, can be performed  using  svcadm(1M).  The  ser-
       vice's status can be queried using the svcs(1) command.

       If  it  is disabled, it will be enabled by mount_nfs(1M), share_nfs(1M), and automountd(1M) unless  its	     application/auto_enable prop-
       erty is set to false.

SunOS 5.10							    18 Nov 2004 							 statd(1M)
All times are GMT -4. The time now is 06:53 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy