[cisco-voip] Unity Connection 7.1(2) rebooted at 1am, wondering why

[Wes Sisk]

possibly a restart initiated from the web page?  forcing that to use CLI 
would certainly simplify auditing.  /wes

On Monday, May 24, 2010 11:34:59 AM, Jason Aarons (US) 
<jason.aarons at us.didata.com> wrote:
>
> The ClientAddress:10.45.100.35 is the server itself.  How can a server 
> SSH to itself and type utils system restart?  I must be mis-reading this!
>
>  
>
> admin:file search activelog audit/AuditApp/* "utils system restart"
>
>  
>
> Searching path: /var/log/active/audit/AuditApp/*
>
> /var/log/active/audit/AuditApp/Audit00000120.log:04/19/2010 
> 17:52:55.159 |LogMessage   UserID :administrator  ClientAddress 
> :10.45.100.35  Severity :3  EventType :CLICommand  
> ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI 
> Command-> utils system restart  ComponentID :CLI App ID:Command Line 
> Cluster ID: Node ID:USUNITY2|
>
> /var/log/active/audit/AuditApp/Audit00000021.log:05/24/2010 
> 09:40:50.279 |LogMessage   UserID :administrator  ClientAddress 
> :10.45.100.35  Severity :3  EventType :CLICommand  
> ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI 
> Command-> utils system restart  ComponentID :CLI App ID:Command Line 
> Cluster ID: Node ID:USUNITY2|
>
> /var/log/active/audit/AuditApp/Audit00000005.log:05/20/2010 
> 19:46:00.981 |LogMessage   UserID :administrator  ClientAddress 
> :10.45.100.35  Severity :3  EventType :CLICommand  
> ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI 
> Command-> utils system restart  ComponentID :CLI App ID:Command Line 
> Cluster ID: Node ID:USUNITY2|
>
> /var/log/active/audit/AuditApp/Audit00000022.log:05/24/2010 
> 10:08:34.371 |LogMessage   UserID :administrator  ClientAddress 
> :10.45.100.35  Severity :3  EventType :CLICommand  
> ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI 
> Command-> file search activelog audit/AuditApp/* "utils system 
> restart"  ComponentID :CLI App ID:Command Line Cluster ID: Node 
> ID:USUNITY2|
>
> /var/log/active/audit/AuditApp/Audit00000020.log:05/24/2010 
> 06:13:15.597 |LogMessage   UserID :administrator  ClientAddress 
> :10.45.100.35  Severity :3  EventType :CLICommand  
> ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI 
> Command-> utils system restart  ComponentID :CLI App ID:Command Line 
> Cluster ID: Node ID:USUNITY2|
>
>  
>
> Search completed
>
>  
>
> *From:* Ryan Ratliff [mailto:rratliff at cisco.com]
> *Sent:* Monday, May 24, 2010 10:45 AM
> *To:* Jason Aarons (US)
> *Cc:* cisco-voip at puck.nether.net
> *Subject:* Re: [cisco-voip] Unity Connection 7.1(2) rebooted at 1am, 
> wondering why
>
>  
>
> You have the syslog, application event log, and if it's an HP server 
> the IML is viewable via 'file view system-management-log'.
>
>  
>
> -Ryan
>
>  
>
> On May 24, 2010, at 9:54 AM, Jason Aarons (US) wrote:
>
>
>
> Unity Connection 7.1.2.20000-2 rebooted at 1am according to show 
> status (uptime).
>
>  
>
> In Windows I can look at the Event Log and determin why a server 
> rebooted, if users chose reboot they have to type an explanation, etc. 
> In Platform what can I look at to ascertain why server rebooted, eg 
> lost power vs utils systems restart, in IOS I can show ver to determin 
> was by "Power On" etc.
>
>  
>
> Oddly it was at exactly 1am.
>
>  
>
> Ideally a show command would be great -jason
>
>  
>
>  
>
> ------------------------------------------------------------------------
>
>  
>
> *Disclaimer: This e-mail communication and any attachments may contain 
> confidential and privileged information and is for use by the 
> designated addressee(s) named above only. If you are not the intended 
> addressee, you are hereby notified that you have received this 
> communication in error and that any use or reproduction of this email 
> or its contents is strictly prohibited and may be unlawful. If you 
> have received this communication in error, please notify us 
> immediately by replying to this message and deleting it from your 
> computer. Thank you.*
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net <mailto:cisco-voip at puck.nether.net>
> https://puck.nether.net/mailman/listinfo/cisco-voip
>
>  
>
> ------------------------------------------------------------------------
>
> *Disclaimer: This e-mail communication and any attachments may contain 
> confidential and privileged information and is for use by the 
> designated addressee(s) named above only. If you are not the intended 
> addressee, you are hereby notified that you have received this 
> communication in error and that any use or reproduction of this email 
> or its contents is strictly prohibited and may be unlawful. If you 
> have received this communication in error, please notify us 
> immediately by replying to this message and deleting it from your 
> computer. Thank you. *
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>   

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20100524/a70a00ec/attachment.html>