Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

CentOS 5.7 VPS (running on OpenVZ)

My VPS shut down this morning and I'm not sure why. I contacted my VPS host and they indicated that the server "was off". They powered it back on but I'm confused on how/why exactly it was shut down. The host didn't volunteer information/opinion on why it was shut down.

I checked /var/log/messages and noticed the following:

Nov 23 11:12:13 echo shutdown[5748]: shutting down for system halt 
Nov 23 11:12:13 echo init: Switching to runlevel: 0 
Nov 23 11:12:13 echo saslauthd[15407]: server_exit     : master exited: 15407 
Nov 23 11:12:20 echo xinetd[12074]: Exiting... Nov 23 11:12:20 echo exiting on signal 15

I checked /var/log/secure and noticed the following:

Nov 23 11:12:13 echo userhelper[5748]: running '/sbin/halt' with root privileges on behalf of 'root' 
Nov 23 11:12:19 echo sshd[11982]: Received signal 15; terminating.

I don't see any unauthorized SSH connections. I have SSH listening on a different port, only accepting authorized keys, and only accepting connections from specific IPs (via iptables restrictions).

Is there anywhere else I can look to prove or disprove the theory that my VPS host did this?


UPDATE: I ran last and here's what I get for the most recent entries (I edited the hostname/username) Both of the one's with "mike" are me and legit.

mike     pts/1        c-11-11-11-11 Wed Nov 23 11:56   still logged in
reboot   system boot  2.6.18-194.8.1.e Wed Nov 23 11:48          (01:42)
mike     pts/0        foo.foo.com Mon Nov 21 16:27 - 20:39  (04:11)

Any idea what the "reboot" is?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You can see that this was triggered by "UserHelper" which is a gui wrapper to pam, but since you don't post any logs previous I still cannot give you a definitive answer to what is using "userhelper".

When executing "last" it will show you date/time of all system reboots. Completely normal and expected.

To see the last reboot you can use:

last reboot | head -1

or if you want to list reboot history just use last reboot

for shutdown info:

last -x|grep shutdown

As for your concern about sshd, the daemon is being terminated with sig 15, per the shutdown procedure, also as expected.

share|improve this answer
    
Thanks! I updated the post with your suggestion. dmesg is empty. –  Mike B Nov 23 '11 at 22:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.