Home / server / Questions / 334221
Accepted
Mike B
Asked: 2011-11-24 12:22:08 +0800 CST

How can I tell who/what shutdown my CentOS VPS?

  • 772

CentOS 5.7 VPS (running on OpenVZ)

My VPS shut down this morning and I'm not sure why. I contacted my VPS host and they indicated that the server "was off". They powered it back on but I'm confused on how/why exactly it was shut down. The host didn't volunteer information/opinion on why it was shut down.

I checked /var/log/messages and noticed the following: 

Nov 23 11:12:13 echo shutdown[5748]: shutting down for system halt 
Nov 23 11:12:13 echo init: Switching to runlevel: 0 
Nov 23 11:12:13 echo saslauthd[15407]: server_exit     : master exited: 15407 
Nov 23 11:12:20 echo xinetd[12074]: Exiting... Nov 23 11:12:20 echo exiting on signal 15

I checked /var/log/secure and noticed the following: 

Nov 23 11:12:13 echo userhelper[5748]: running '/sbin/halt' with root privileges on behalf of 'root' 
Nov 23 11:12:19 echo sshd[11982]: Received signal 15; terminating.

I don't see any unauthorized SSH connections. I have SSH listening on a different port, only accepting authorized keys, and only accepting connections from specific IPs (via iptables restrictions).

Is there anywhere else I can look to prove or disprove the theory that my VPS host did this?

UPDATE: I ran last and here's what I get for the most recent entries (I edited the hostname/username) Both of the one's with "mike" are me and legit. 

mike     pts/1        c-11-11-11-11 Wed Nov 23 11:56   still logged in
reboot   system boot  2.6.18-194.8.1.e Wed Nov 23 11:48          (01:42)
mike     pts/0        foo.foo.com Mon Nov 21 16:27 - 20:39  (04:11)

Any idea what the "reboot" is?

linux centos vps openvz unexpected-shutdown

1 Answers

  1. Best Answer

    You can see that this was triggered by "UserHelper" which is a gui wrapper to pam, but since you don't post any logs previous I still cannot give you a definitive answer to what is using "userhelper".

    When executing "last" it will show you date/time of all system reboots. Completely normal and expected.

    To see the last reboot you can use:

    last reboot | head -1

    or if you want to list reboot history just use last reboot

    for shutdown info:

    last -x|grep shutdown

    As for your concern about sshd, the daemon is being terminated with sig 15, per the shutdown procedure, also as expected.

    • 5