detecting what does a reboot

[Rabin Yasharzadehe]

you can try with auditctl

auditctl -w /tmp/1 -p wa -k write_or_access
>


*--Rabin*


On Sun, Jun 8, 2014 at 12:11 PM, ik <idokan at gmail.com> wrote:

> Hello
>
> I have a server (old centos 5) that does sometimes few times a reboot, in
> random hours.
> I removed non root permissions to execute halt, reboot and shutdown, but I
> wish also to try and track down what causing that reboot.
>
> Is there a way to audit-trail or just log any kind of rebooting request
> (including system calls), and finding out what or whom execute it ?
>
> Thanks,
>
> Ido
>
> _______________________________________________
> Linux-il mailing list
> Linux-il at cs.huji.ac.il
> http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.cs.huji.ac.il/pipermail/linux-il/attachments/20140608/0ccd73d1/attachment.html>