CentOS 5.7 VPS (running on OpenVZ)
My VPS shut down this morning and I'm not sure why. I contacted my VPS host and they indicated that the server "was off". They powered it back on but I'm confused on how/why exactly it was shut down. The host didn't volunteer information/opinion on why it was shut down.
I checked /var/log/messages and noticed the following:
Nov 23 11:12:13 echo shutdown: shutting down for system halt Nov 23 11:12:13 echo init: Switching to runlevel: 0 Nov 23 11:12:13 echo saslauthd: server_exit : master exited: 15407 Nov 23 11:12:20 echo xinetd: Exiting... Nov 23 11:12:20 echo exiting on signal 15
I checked /var/log/secure and noticed the following:
Nov 23 11:12:13 echo userhelper: running '/sbin/halt' with root privileges on behalf of 'root' Nov 23 11:12:19 echo sshd: Received signal 15; terminating.
I don't see any unauthorized SSH connections. I have SSH listening on a different port, only accepting authorized keys, and only accepting connections from specific IPs (via iptables restrictions).
Is there anywhere else I can look to prove or disprove the theory that my VPS host did this?
UPDATE: I ran
last and here's what I get for the most recent entries (I edited the hostname/username) Both of the one's with "mike" are me and legit.
mike pts/1 c-11-11-11-11 Wed Nov 23 11:56 still logged in reboot system boot 2.6.18-194.8.1.e Wed Nov 23 11:48 (01:42) mike pts/0 foo.foo.com Mon Nov 21 16:27 - 20:39 (04:11)
Any idea what the "reboot" is?