[cisco-voip] Unity Connection 7.1(2) rebooted at 1am, wondering why

[Ryan Ratliff]

CLI logs would confirm if the reset was truly done from the CLI, as opposed to audit logs.

-Ryan

On May 24, 2010, at 12:06 PM, Wes Sisk wrote:

> possibly a restart initiated from the web page?  forcing that to use CLI would certainly simplify auditing.  /wes
> 
> On Monday, May 24, 2010 11:34:59 AM, Jason Aarons (US) <jason.aarons at us.didata.com> wrote:
>> The ClientAddress:10.45.100.35 is the server itself.  How can a server SSH to itself and type utils system restart?  I must be mis-reading this!
>>  
>> admin:file search activelog audit/AuditApp/* "utils system restart"
>>  
>> Searching path: /var/log/active/audit/AuditApp/*
>> /var/log/active/audit/AuditApp/Audit00000120.log:04/19/2010 17:52:55.159 |LogMessage   UserID :administrator  ClientAddress :10.45.100.35  Severity :3  EventType :CLICommand  ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI Command-> utils system restart  ComponentID :CLI App ID:Command Line Cluster ID: Node ID:USUNITY2|
>> /var/log/active/audit/AuditApp/Audit00000021.log:05/24/2010 09:40:50.279 |LogMessage   UserID :administrator  ClientAddress :10.45.100.35  Severity :3  EventType :CLICommand  ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI Command-> utils system restart  ComponentID :CLI App ID:Command Line Cluster ID: Node ID:USUNITY2|
>> /var/log/active/audit/AuditApp/Audit00000005.log:05/20/2010 19:46:00.981 |LogMessage   UserID :administrator  ClientAddress :10.45.100.35  Severity :3  EventType :CLICommand  ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI Command-> utils system restart  ComponentID :CLI App ID:Command Line Cluster ID: Node ID:USUNITY2|
>> /var/log/active/audit/AuditApp/Audit00000022.log:05/24/2010 10:08:34.371 |LogMessage   UserID :administrator  ClientAddress :10.45.100.35  Severity :3  EventType :CLICommand  ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI Command-> file search activelog audit/AuditApp/* "utils system restart"  ComponentID :CLI App ID:Command Line Cluster ID: Node ID:USUNITY2|
>> /var/log/active/audit/AuditApp/Audit00000020.log:05/24/2010 06:13:15.597 |LogMessage   UserID :administrator  ClientAddress :10.45.100.35  Severity :3  EventType :CLICommand  ResourceAccessed:GenericCLI  EventStatus :Success  AuditDetails :CLI Command-> utils system restart  ComponentID :CLI App ID:Command Line Cluster ID: Node ID:USUNITY2|
>>  
>> Search completed
>>  
>> From: Ryan Ratliff [mailto:rratliff at cisco.com] 
>> Sent: Monday, May 24, 2010 10:45 AM
>> To: Jason Aarons (US)
>> Cc: cisco-voip at puck.nether.net
>> Subject: Re: [cisco-voip] Unity Connection 7.1(2) rebooted at 1am, wondering why
>>  
>> You have the syslog, application event log, and if it's an HP server the IML is viewable via 'file view system-management-log'.
>>  
>> -Ryan
>>  
>> On May 24, 2010, at 9:54 AM, Jason Aarons (US) wrote:
>> 
>> 
>> Unity Connection 7.1.2.20000-2 rebooted at 1am according to show status (uptime).
>>  
>> In Windows I can look at the Event Log and determin why a server rebooted, if users chose reboot they have to type an explanation, etc. In Platform what can I look at to ascertain why server rebooted, eg lost power vs utils systems restart, in IOS I can show ver to determin was by “Power On” etc.
>>  
>> Oddly it was at exactly 1am.
>>  
>> Ideally a show command would be great -jason
>>  
>>  
>>  
>> Disclaimer: This e-mail communication and any attachments may contain confidential and privileged information and is for use by the designated addressee(s) named above only. If you are not the intended addressee, you are hereby notified that you have received this communication in error and that any use or reproduction of this email or its contents is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer. Thank you.
>> 
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>  
>> Disclaimer: This e-mail communication and any attachments may contain confidential and privileged information and is for use by the designated addressee(s) named above only. If you are not the intended addressee, you are hereby notified that you have received this communication in error and that any use or reproduction of this email or its contents is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer. Thank you.
>> 
>> 
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>   
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20100524/edf95f31/attachment.html>