7

CentOS 5.7 VPS (running on OpenVZ)

My VPS shut down this morning and I'm not sure why. I contacted my VPS host and they indicated that the server "was off". They powered it back on but I'm confused on how/why exactly it was shut down. The host didn't volunteer information/opinion on why it was shut down.

I checked /var/log/messages and noticed the following: 

Nov 23 11:12:13 echo shutdown[5748]: shutting down for system halt 
Nov 23 11:12:13 echo init: Switching to runlevel: 0 
Nov 23 11:12:13 echo saslauthd[15407]: server_exit     : master exited: 15407 
Nov 23 11:12:20 echo xinetd[12074]: Exiting... Nov 23 11:12:20 echo exiting on signal 15

I checked /var/log/secure and noticed the following: 

Nov 23 11:12:13 echo userhelper[5748]: running '/sbin/halt' with root privileges on behalf of 'root' 
Nov 23 11:12:19 echo sshd[11982]: Received signal 15; terminating.

I don't see any unauthorized SSH connections. I have SSH listening on a different port, only accepting authorized keys, and only accepting connections from specific IPs (via iptables restrictions).

Is there anywhere else I can look to prove or disprove the theory that my VPS host did this?

UPDATE: I ran last and here's what I get for the most recent entries (I edited the hostname/username) Both of the one's with "mike" are me and legit. 

mike     pts/1        c-11-11-11-11 Wed Nov 23 11:56   still logged in
reboot   system boot  2.6.18-194.8.1.e Wed Nov 23 11:48          (01:42)
mike     pts/0        foo.foo.com Mon Nov 21 16:27 - 20:39  (04:11)

Any idea what the "reboot" is?

quanta
  • 50,327
  • 19
  • 152
  • 213
Mike B
  • 11,570
  • 42
  • 106
  • 165

1 Answers1

5

You can see that this was triggered by "UserHelper" which is a gui wrapper to pam, but since you don't post any logs previous I still cannot give you a definitive answer to what is using "userhelper".

When executing "last" it will show you date/time of all system reboots. Completely normal and expected.

To see the last reboot you can use:

last reboot | head -1

or if you want to list reboot history just use last reboot

for shutdown info:

last -x|grep shutdown

As for your concern about sshd, the daemon is being terminated with sig 15, per the shutdown procedure, also as expected.

Michael Steinfeld
  • 396
  • 2
  • 5