[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: strange reboot on woody

On Thu, 2003-11-27 at 07:59, Haim Ashkenazi wrote:

> ...
> ov 26 22:26:16 ns-ilweb1 init: Switching to runlevel: 6
> Nov 26 22:26:19 ns-ilweb1 qmail: 1069878379.427182 status: exiting
> Nov 26 22:26:20 ns-ilweb1 ntpd[32551]: ntpd exiting on signal 15
> Nov 26 22:26:22 ns-ilweb1 exiting on signal 15
> Nov 26 22:28:09 ns-ilweb1 syslogd 1.4.1#10: restart.

FYI, that looks like it may be a keyboard Ctrl-Alt-Del. Here is what one
looks like in syslog:

Nov 27 08:05:52 galileo init: Switching to runlevel: 6
Nov 27 08:05:54 galileo kernel: NVRM: AGPGART: freed 16 pages
Nov 27 08:05:55 galileo last message repeated 2 times
Nov 27 08:05:55 galileo kernel: NVRM: AGPGART: backend released
Nov 27 08:05:55 galileo xfs[551]: terminating 
Nov 27 08:05:56 galileo ntpd[554]: ntpd exiting on signal 15
Nov 27 08:05:57 galileo kernel: usb.c: USB disconnect on device 1
Nov 27 08:05:57 galileo kernel: Kernel logging (proc) stopped.
Nov 27 08:05:57 galileo kernel: Kernel log daemon terminating.
Nov 27 08:05:57 galileo exiting on signal 15

Naturally, you won't see AGPGART or xfs (X font server) messages on a
web server.

> ...
> I've run chkrootkit (last version from unstable) and it didn't find
> anything. I've gone to the logs and didn't see nothing suspicious.
> (messages, wtmp, faillog, authlog, kern.log).
> also, nothing suspicious in '/root/bash_history'.

but, was there a shutdown -r now or the like?

/me expected Sherlock Holmes to pop up commenting about the LACK of
something happening being quite suspicious

> Is there anything else I can do to check why it rebooted suddenly?

Possibly, take the on-duty tech at the colo out to a pub. Also, running
something like 'debsums' would be warranted.[0]

[0] Debsums, of course, can only prove that something is wrong, not
    that something isn't.

Attachment: signature.asc
Description: This is a digitally signed message part

Reply to: