System shutdown

[nitinkgoud]

Hi Guys,
I was setting up a system for a new project.
But last weekend someone/something rebooted the system and on tuesday we found that the system was at OK prompt.
I want to find who or what did it?
Any suggestions on what to look at ?
I used dmesg,last and looked at /var/adm/messages?
Can you please tell me what to look at in these files/commands or any other command!

Please help.

 

[cndcadams]

nitinkgoud;

double check and make sure that power management is not set up to shut the system down.

Thanks

CA

 

[djr111]

first of all, I hope you do not have it so you can log in directly as root. If you do, and someone did do this, good luck finding out who did it. As a rule a user should be forced to 'su' to root, you can find a record of users or accounts that 'su' to root in the /var/adm/sulog. The only other instance that I notice it is hard to manage is if you have an account on a box that has root priviledges, usually a generic account that many people know the passwd to. This is annoying and a risk, but sometimes out of your hands.

maybe you can find an entry in the sulog and compare it to when the system rebooted...The 'last' command should tell you when the system was rebooted last.


hope this helps

 

[cndcadams]

nitinkgoud;

Couple more things to check. Is auto-boot set to true or false?

When it was at the ok prompt did you type boot or poweroff then on the system. If it was a crash (if you just typed boot) check your /var/crash/(hostname) and look for unix.# and vmcore.#.

also do more /var/adm/messages | grep -i warning and make sure you were not getting any warnings.


CA

 

[djr111]

To go along with Nitinkgoud's post, I believe if it was a crash and your system is at the 'ok' prompt. it is a good process to type 'sync' prior to typing boot. I believe this writes what is in memory to disk as far as errors/core.

I believe.


check prtdiag -v , see if you see anything out of the ordinary there, maybe something failed, usually though if something fails there it is recorded in the messages file, but who knows sometimes these systems have a mind of their own.

 

[nitinkgoud]

Hi Guys,
I raised a call with sun gave them the explorer output, they could not find the reason.
I did not see a core dump.......because i did not use sync at ok prompt.
And yes people can log in as root directly to this box!!

Thanks for the time and effort guys.

 

[coffeysm]

You can check the last command see who logged on before it shutdown. Odds are though they logged in as root, I hate when people change stuff and what not. I work with a guy now who constantly makes changes to systems and scripts that I wrote that have been working forever. He still never admits he did it, when I have the proof right in his face.