if system syslog configured for small file size and small rotation,
file syslog {
any info;
archive size 1m files 1;
}
A malevolent could set small file size and archive to a low number. what's
worse set a cronjob from the shell that could force reboots. Please disavow
me of my understanding. But a very good reason to restrict shell access and
ensure the sudoers are few.
But seriously
show log mgd
show log auditd
show log security
If you have it set up in system syslog config stanza, IMHO use the facillity
provided by a hard-drive storage system to utillise as much of the trace
functionality as is possible.
these are the places I would start
Marvin Android
'don't stop me now, I'm hating this'
----- Original Message -----
From: "Erdem Sener" <[EMAIL PROTECTED]>
To: "Christian Koch" <[EMAIL PROTECTED]>
Cc: <[email protected]>
Sent: Friday, January 12, 2007 9:05 PM
Subject: Re: [j-nsp] Reboot Reason?
> Hi,
>
> You can do a 'show log user' and see at least if the reboot was
> initiated by a user, if there's no information on messages file.
>
> such as:
>
> [EMAIL PROTECTED]> show log user
> lab ttyp0 10.10.1.34 Fri Jan 12 21:06 -
> 21:06 (00:00)
> lab ttyp0 10.10.1.22 Fri Jan 12 20:06 -
> 20:06 (00:00)
> reboot ~ Fri Jan 12 15:30
>
> Also, I'd suggest to check your configuration at [edit system syslog]
> to check whether the messages file is configured with very small
> rotation options.
>
> HTH
>
>
> On 1/12/07, Christian Koch <[EMAIL PROTECTED]> wrote:
>> Hi Georg,
>>
>> Thanks for the info but I didn't see any reason in the logs, maybe they
>> just got wiped, I was hopinh there was actually another way
>>
>> Thanks!
>>
>> |-----Original Message-----
>> |From: Georg Bachler [mailto:[EMAIL PROTECTED]
>> |Sent: Friday, January 12, 2007 9:59 AM
>> |To: Christian Koch
>> |Cc: [email protected]
>> |Subject: Re: [j-nsp] Reboot Reason?
>> |
>> |Hi Christian,
>> |
>> | have a look at the log messages, like e.g.
>> |
>> |[EMAIL PROTECTED]> show log messages |match reboot Jan 12 09:29:13
>> |pula mgd[12082]: UI_REBOOT_EVENT: System rebooted by 'georg'
>> |Jan 12 09:29:20 pula shutdown: reboot by remote:
>> |Jan 12 09:31:42 pula savecore: Router rebooting after a
>> |normal shutdown....
>> |
>> |--
>> |Kind regards,
>> | Georg
>> | JTAC EMEA
>> |
>> |
>> |Friday, January 12, 2007, 3:25:18 PM, you wrote:
>> |
>> |CK> Is there anyway I can see the reasons the router was
>> |restarted on the
>> |CK> m40?
>> |
>> |CK> Like on a cisco, last reboot by power on, etc..
>> |
>> |CK> thanks
>> |CK> _______________________________________________
>> |CK> juniper-nsp mailing list [email protected]
>> |CK> https://puck.nether.net/mailman/listinfo/juniper-nsp
>> |
>> |
>>
>> _______________________________________________
>> juniper-nsp mailing list [email protected]
>> https://puck.nether.net/mailman/listinfo/juniper-nsp
>>
>
>
> --
> Erdem
> _______________________________________________
> juniper-nsp mailing list [email protected]
> https://puck.nether.net/mailman/listinfo/juniper-nsp
>
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
