[j-nsp] Reboot Reason?

[Evan Williams]

if system syslog configured for small  file size and small rotation,

file syslog {

any info;

archive size 1m files 1;

}

A malevolent could set small file size and archive to a low number. what's 
worse set a cronjob from the shell that could force reboots. Please disavow 
me of my understanding. But a very good reason to restrict shell access and 
ensure the sudoers are few.
But seriously

show log mgd
show log auditd
show log security
If you have it set up in system syslog config stanza, IMHO use the facillity 
provided by a hard-drive storage system to utillise as much of the trace 
functionality as is possible.
these are the places I would start

Marvin Android
'don't stop me now, I'm hating this'

----- Original Message ----- 
From: "Erdem Sener" <erdems at gmail.com>
To: "Christian Koch" <ckoch at globix.com>
Cc: <juniper-nsp at puck.nether.net>
Sent: Friday, January 12, 2007 9:05 PM
Subject: Re: [j-nsp] Reboot Reason?


> Hi,
>
>  You can do a 'show log user' and see at least if the reboot was
> initiated by a user, if there's no information on messages file.
>
> such as:
>
> lab at router> show log user
> lab      ttyp0    10.10.1.34                     Fri Jan 12 21:06 -
> 21:06  (00:00)
> lab      ttyp0    10.10.1.22                     Fri Jan 12 20:06 -
> 20:06  (00:00)
> reboot   ~                                         Fri Jan 12 15:30
>
> Also, I'd suggest to check your configuration at [edit system syslog]
> to check whether the messages file is configured with very small
> rotation options.
>
> HTH
>
>
> On 1/12/07, Christian Koch <ckoch at globix.com> wrote:
>> Hi Georg,
>>
>> Thanks for the info but I didn't see any reason in the logs, maybe they
>> just got wiped, I was hopinh there was actually another way
>>
>> Thanks!
>>
>> |-----Original Message-----
>> |From: Georg Bachler [mailto:gbachler at juniper.net]
>> |Sent: Friday, January 12, 2007 9:59 AM
>> |To: Christian Koch
>> |Cc: juniper-nsp at puck.nether.net
>> |Subject: Re: [j-nsp] Reboot Reason?
>> |
>> |Hi Christian,
>> |
>> |  have a look at the log messages, like e.g.
>> |
>> |georg at pula> show log messages |match reboot Jan 12 09:29:13
>> |pula mgd[12082]: UI_REBOOT_EVENT: System rebooted by 'georg'
>> |Jan 12 09:29:20  pula shutdown: reboot by remote:
>> |Jan 12 09:31:42  pula savecore: Router rebooting after a
>> |normal shutdown....
>> |
>> |--
>> |Kind regards,
>> | Georg
>> | JTAC EMEA
>> |
>> |
>> |Friday, January 12, 2007, 3:25:18 PM, you wrote:
>> |
>> |CK> Is there anyway I can see the reasons the router was
>> |restarted on the
>> |CK> m40?
>> |
>> |CK> Like on a cisco, last reboot by power on, etc..
>> |
>> |CK> thanks
>> |CK> _______________________________________________
>> |CK> juniper-nsp mailing list juniper-nsp at puck.nether.net
>> |CK> https://puck.nether.net/mailman/listinfo/juniper-nsp
>> |
>> |
>>
>> _______________________________________________
>> juniper-nsp mailing list juniper-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/juniper-nsp
>>
>
>
> -- 
> Erdem
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/juniper-nsp
>