SUMMARY:Finding system shutdown information

I got few response for this problem, finally we figured out somebody
pressed power key.

Here are response

1.
prtdiag -v ?   Enterprise-class systems would report hardware problems
(including AC Powser Failure) here; being follow-ons, I'd expect SunFire
to do that, too.

2.
Try checking the console logs in the RSC card. IIRC the
command is:


/usr/platform/`uname -i`/rsc/rscadm showlogs

3.
* If the system was shutdown in an ordinal fashion then
/var/adm/messages will show you when it went down and came back up.
* If someone su'd to root then it should be in the sulog and the times
will tie up with what's in /var/adm/messages
* check all user .sh_history files for "shutdown, init 6 & reboot" with
something like this:

for user in `cat /etc/passwd|cut -d: -f1`
do
    egrep 'shutdown | init | reboot' ~$user/.sh_history
done

* If the system crashed then check /var/crash/`uname -n` for core files.
If your system is not set up for coredumps then now is the time to set it!
* Also grep you run-level scripts for "shutdown, reboot and init
entries" Maybe an application user account has access to a run-level
shutdown script.

4.
last
dmesg
look for dumps in /var/crash/$HOSTNAME
make sure your dump device is configured correctly ;-) (dumpadm)

Thanks you all.

Sundaram
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers