detecting what does a reboot

[Diego Iastrubni]

And when everything else fails - good old serial console and another 
machine to capture the last dieing words of this server.

On 06/08/2014 01:21 PM, Rabin Yasharzadehe wrote:
> you can try with auditctl
>
>     auditctl -w /tmp/1 -p wa -k write_or_access
>
>
> *--
> Rabin*
>
>
> On Sun, Jun 8, 2014 at 12:11 PM, ik <idokan at gmail.com 
> <mailto:idokan at gmail.com>> wrote:
>
>     Hello
>
>     I have a server (old centos 5) that does sometimes few times a
>     reboot, in random hours.
>     I removed non root permissions to execute halt, reboot and
>     shutdown, but I wish also to try and track down what causing that
>     reboot.
>
>     Is there a way to audit-trail or just log any kind of rebooting
>     request (including system calls), and finding out what or whom
>     execute it ?
>
>     Thanks,
>
>     Ido
>
>     _______________________________________________
>     Linux-il mailing list
>     Linux-il at cs.huji.ac.il <mailto:Linux-il at cs.huji.ac.il>
>     http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il
>
>
>
>
> _______________________________________________
> Linux-il mailing list
> Linux-il at cs.huji.ac.il
> http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il