On Thu, 2003-11-27 at 07:59, Haim Ashkenazi wrote: > ... > ov 26 22:26:16 ns-ilweb1 init: Switching to runlevel: 6 > Nov 26 22:26:19 ns-ilweb1 qmail: 1069878379.427182 status: exiting > Nov 26 22:26:20 ns-ilweb1 ntpd[32551]: ntpd exiting on signal 15 > Nov 26 22:26:22 ns-ilweb1 exiting on signal 15 > Nov 26 22:28:09 ns-ilweb1 syslogd 1.4.1#10: restart. FYI, that looks like it may be a keyboard Ctrl-Alt-Del. Here is what one looks like in syslog: Nov 27 08:05:52 galileo init: Switching to runlevel: 6 Nov 27 08:05:54 galileo kernel: NVRM: AGPGART: freed 16 pages Nov 27 08:05:55 galileo last message repeated 2 times Nov 27 08:05:55 galileo kernel: NVRM: AGPGART: backend released Nov 27 08:05:55 galileo xfs[551]: terminating Nov 27 08:05:56 galileo ntpd[554]: ntpd exiting on signal 15 Nov 27 08:05:57 galileo kernel: usb.c: USB disconnect on device 1 ... Nov 27 08:05:57 galileo kernel: Kernel logging (proc) stopped. Nov 27 08:05:57 galileo kernel: Kernel log daemon terminating. Nov 27 08:05:57 galileo exiting on signal 15 Naturally, you won't see AGPGART or xfs (X font server) messages on a web server. > ... > > I've run chkrootkit (last version from unstable) and it didn't find > anything. I've gone to the logs and didn't see nothing suspicious. > (messages, wtmp, faillog, authlog, kern.log). > > also, nothing suspicious in '/root/bash_history'. but, was there a shutdown -r now or the like? /me expected Sherlock Holmes to pop up commenting about the LACK of something happening being quite suspicious > > Is there anything else I can do to check why it rebooted suddenly? Possibly, take the on-duty tech at the colo out to a pub. Also, running something like 'debsums' would be warranted.[0] [0] Debsums, of course, can only prove that something is wrong, not that something isn't.
Attachment:
signature.asc
Description: This is a digitally signed message part