last day (14 days later) » 

Stack Exchange
Stack Exchange
9:50 PM
0
A: Log Shutdown Command Usage/Message

Korjavin IvanYou can modify syslog.conf to trap this messages. for example, if you have standard syslog then line *.* /var/log/all.log store all messages. If you have rsyslog (modern debian for example) you can start some script (send email etc) on event

 
ACase
ACase
Doesn't work. I use rsyslog, but the shutdown command doesn't seem to get sent to syslog so rsyslog doesn't pick it up (other messages are logged fine).
 
Korjavin Ivan
Korjavin Ivan
$LogRSyslogStatusMessages [on/off] - If set to on (the default), rsyslog emits message on startup and shutdown

i mean, if rsyslog not saw kernel message, it was shudowned himself, so lets see when rsyslog was switchoff
I use freebsd mostly, and always see something like

'date rebooted by username '
in all.log

my be in linux its work different
 
ACase
ACase
Doesn't look like it's a feature of my version 4.6.2, looks like it got added in 4.7: git.adiscon.com/… :(
It could be I just don't have the right input modules loaded. What im's do you have?
 
Korjavin Ivan
Korjavin Ivan
gtalk : korjavin@gmail.com
if i understand im`s right. Like instant messaging ;)
hi
 
ACase
ACase
Korjavin: that option looks like it only covers rsyslog start/stop
not shutdown messages broadcasted on the system
which is what I'm looking to catch
as in the status of Rsyslog
 
Korjavin Ivan
Korjavin Ivan
10:00 PM
i just wamnt to say then when server shutdowned rsyslog shutdown too
but, if you want 'cancel' shutdowm its useless, yes
 
ACase
ACase
I see, that's not really helpful for what I'm trying to do
yeah
I added a clarfication to the question to try and make it more clear
 
Korjavin Ivan
Korjavin Ivan
what about a) modify reboot source or b) deny use it to all other users
 
ACase
ACase
Basically I want to catch the broadcast messages and email them to our monitoring sweet
suite
 
Korjavin Ivan
Korjavin Ivan
sec
hmm, dont reboot any server last time
and have only 7 days of all.log
so, cant copy string with reboot. But i sure that i have it on my bsd servers
so, what about replace reboot with you custom script, with email etc...
 
ACase
ACase
hmmm... is there a way to read tty0 output into rsyslog?
that's a possibility
 
Korjavin Ivan
Korjavin Ivan
10:07 PM
ls -la /sbin/reboot
/sbin/reboot -> halt
 
ACase
ACase
I was hoping for just a syslog option but it doesn't sound like it. Post that as a solution and I'll take it
 
Korjavin Ivan
Korjavin Ivan
ok
 
ACase
ACase
Well not that, but I'll write a wrapper for shutdown that sends mail.
 
Korjavin Ivan
Korjavin Ivan
Dont accept my answer
Somebody post better about same idea - wrapper
bye ;)
 

last day (14 days later) »