you can try with auditctl auditctl -w /tmp/1 -p wa -k write_or_access >
*--Rabin* On Sun, Jun 8, 2014 at 12:11 PM, ik <[email protected]> wrote: > Hello > > I have a server (old centos 5) that does sometimes few times a reboot, in > random hours. > I removed non root permissions to execute halt, reboot and shutdown, but I > wish also to try and track down what causing that reboot. > > Is there a way to audit-trail or just log any kind of rebooting request > (including system calls), and finding out what or whom execute it ? > > Thanks, > > Ido > > _______________________________________________ > Linux-il mailing list > [email protected] > http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il > >
_______________________________________________ Linux-il mailing list [email protected] http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il
