RHEL 4.4: Unexpected shutdown

[toravionly]

Hi,
I am encountering a wierd problem on my Linux Server. There has been 2 unexpected shutdowns in the last 10 days and the reason is unknown. The strange thing is that I have some other Linux servers, but it is only 1 particular server which shuts down.

The /var/log/messages files show the following entries.

Mar 27 07:49:17 icsinoierd013 kernel: ide-cd: cmd 0x25 timed out
Mar 27 07:49:17 icsinoierd013 kernel: hda: irq timeout: status=0xd0 { Busy }
Mar 27 07:49:17 icsinoierd013 kernel: hda: irq timeout: error=0x00
Mar 27 07:49:17 icsinoierd013 kernel: hda: ATAPI reset complete
Mar 29 04:02:35 icsinoierd013 cups: cupsd shutdown succeeded
Mar 29 04:02:36 icsinoierd013 cups: cupsd startup succeeded


Mar 29 04:02:36 icsinoierd013 syslogd 1.4.1: restart.
Mar 29 10:26:50 icsinoierd013 shutdown: shutting down for system halt
Mar 29 10:26:51 icsinoierd013 init: Switching to runlevel: 0
Mar 29 10:26:52 icsinoierd013 gpm[3548]: *** info [mice.c(1766)]:
Mar 29 10:26:52 icsinoierd013 gpm[3548]: imps2: Auto-detected intellimouse PS/2
Mar 29 10:26:52 icsinoierd013 cups-config-daemon: cups-config-daemon -TERM succeeded
Mar 29 10:26:52 icsinoierd013 haldaemon: haldaemon -TERM succeeded
Mar 29 10:26:52 icsinoierd013 messagebus: messagebus -TERM succeeded
Mar 29 10:26:52 icsinoierd013 atd: atd shutdown succeeded
Mar 29 10:26:52 icsinoierd013 cups: cupsd shutdown succeeded
Mar 29 10:26:52 icsinoierd013 xfs[3581]: terminating
Mar 29 10:26:52 icsinoierd013 xfs: xfs shutdown succeeded
Mar 29 10:26:52 icsinoierd013 gpm: gpm shutdown succeeded
Mar 29 10:26:52 icsinoierd013 sshd: sshd -TERM succeeded
Mar 29 10:26:53 icsinoierd013 sendmail: sendmail shutdown succeeded
Mar 29 10:26:53 icsinoierd013 sendmail: sm-client shutdown succeeded
Mar 29 10:26:53 icsinoierd013 smartd: smartd shutdown failed
Mar 29 10:26:53 icsinoierd013 vsftpd: vsftpd shutdown succeeded
Mar 29 10:26:53 icsinoierd013 xinetd[3500]: Exiting...
Mar 29 10:26:53 icsinoierd013 xinetd: xinetd shutdown succeeded
Mar 29 10:26:53 icsinoierd013 acpid: acpid shutdown succeeded
Mar 29 10:26:53 icsinoierd013 crond: crond shutdown succeeded
Mar 29 10:26:53 icsinoierd013 rpc.statd[3310]: Caught signal 15, un-registering and exiting.
Mar 29 10:26:54 icsinoierd013 nfslock: rpc.statd shutdown succeeded
Mar 29 10:26:54 icsinoierd013 irqbalance: irqbalance shutdown succeeded
Mar 29 10:26:54 icsinoierd013 portmap: portmap shutdown succeeded
Mar 29 10:26:54 icsinoierd013 kernel: Kernel logging (proc) stopped.
Mar 29 10:26:54 icsinoierd013 kernel: Kernel log daemon terminating.
Mar 29 10:26:55 icsinoierd013 syslog: klogd shutdown succeeded
Mar 29 10:26:55 icsinoierd013 exiting on signal 15


Any clues as to why this might be happening?
Regards,
Ravi

[Fantaman]

cron jobs in crontab .?

[rtdrury]

Try this:
find /etc -name \* | xargs grep "shutdown -r now"
As root, replace the "shutdown -r now" in each file with:
"touch /tmp/filename" where filename is the name of the file you're editing.
ls -lt /tmp to find who's restarting the comp. This should at least narrow it down.

[toravionly]

@Fantaman

I could not see any cron jobs.

@rtdrury

I get the following command on running the command:

find /etc -name \* | xargs grep "shutdown -r now"
/etc/X11/gdm/gdm.conf:#RebootCommand=/sbin/reboot;/sbin/shutdown -r now;/usr/sbin/shutdown -r now;/usr/bin/reboot
/etc/X11/gdm/factory-gdm.conf:#RebootCommand=/sbin/reboot;/sbin/shutdown -r now;/usr/sbin/shutdown -r now;/usr/bin/reboot
/etc/gpm-root.conf:# "reboot" f.bgcmd "/sbin/shutdown -r now"
/etc/rc.d/rc0.d/K75netfs: shutdown -r now
/etc/rc.d/rc5.d/S25netfs: shutdown -r now
/etc/rc.d/rc2.d/K75netfs: shutdown -r now
/etc/rc.d/rc6.d/K75netfs: shutdown -r now
/etc/rc.d/rc3.d/S25netfs: shutdown -r now
/etc/rc.d/rc1.d/K75netfs: shutdown -r now
/etc/rc.d/rc4.d/S25netfs: shutdown -r now
/etc/rc.d/init.d/netfs: shutdown -r now


Also, when I check the system log then I see a lot of segment faults of the following nature:

kernel: frmweb[11078]: segfault at 0000000000697465e rip 00000000000f7dd92c1 rsp 0000000000000000ffff6794 error 4

Could this be an issue?