did you check users history ?
what about installing psacct, you can then use lastcomm
>>from yum
The psacct package contains several utilities for monitoring process
activities, including ac, lastcomm, accton and sa. The ac command
displays statistics about how long users have been logged on. The
lastcomm command displays information about previous executed
commands. The accton command turns process accounting on or off. The
sa command summarizes information about previously executed
commmands.
/KB
On 09/03/2011 09:36, Ger Hooton wrote:
> Hi again,
> When I run the command 'last' I note the following result:
> dilip pts/5 143.239.132.150 Sun Mar 6 17:22 - down (00:50)
>> Is this telling me that the user dilip shoutdown the system?
> OR that a process own by dilip caused the shutdown?
>> The user dilip was logged in via ssh
>> I got this reply from the user dilip
> "Yes I was online when it happened. The terminal said halting system.
> Mostly I was running nanosim in batchmode. I thought it was some
> automated backup process shutting down that particular machine.
> Any clue why it happened (unless otherwise some ghost in the
> machine :) )?"
>> I need to get to the bottom of this so any ideas??
>> //Ger
>>>>
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
