detecting what does a reboot

[Oron Peled]

On Sunday 08 June 2014 22:43:49 ik wrote:
> We ruled out that it happens from hardware, and at the messages log, you
> see a normal reboot, we just can't place the finger who or what does it.

It's easy to confirm/reject that's the "reboot" command itself:
 * Move original command to new name (e.g: /sbin/reboot.orig)
 * Put in its place (e.g: /sbin/reboot) a short script.
 * The script would simply run: "pstree -p >> /root/reboot.log"

Look at the process hierarchy in the log to find the culprit.

If this log isn't generated, that means somebody doesn't run "reboot"
but do an equivalent operation from software...

-- 
Oron Peled                                 Voice: +972-4-8228492
oron at actcom.co.il                  http://users.actcom.co.il/~oron
“If I have seen a little further it is by standing on the shoulders of Giants."
 --Isaac Newton.