Hi Martin, @ 12:06:00 PM on 10/30/2001, Martin Leweling wrote: ML> Well, init runlevel 6 is (intentional) reboot. Yep, knew that. :-) (I realize I sound like (and probably am) an idiot when it comes to this stuff though.) ML> Nothing strange here other than you not knowing who reboots your ML> machine. Which raises the question whether (a) other people know ML> your root password, (b) anyone can use ctrl-alt-del if it's not ML> disabled, or (c) kdm lets anyone shut down the machine. (a), (b) ML> and (c) all considered insecure ... ;-) Well there's only two possibilities: me or the other admin. The other admin suggested I ask the list. (he's a very good fried, no worries there.) The first I listed is really only what I'm worried about. The second looks like updatedb? ML> Check the login entries ("last") who was logged in at the reboot ML> times and beat him/her up (unless it was a cracker). ftp ftp pD9E1D669.dip.t- Tue Oct 30 04:52 - 04:52 (00:00) reboot system boot 2.4.12-4GB Tue Oct 30 00:37 (12:33) mk pts/0 user531.io-mar Mon Oct 29 16:40 - down (07:55) .... mk was me last night.. reboot system boot 2.4.12-4GB Sun Oct 28 23:18 (1+01:17) ftp ftp pD9E42DCC.dip.t- Sun Oct 28 15:27 - 15:27 (00:00) ftp ftp p3EE20C83.dip.t- Sun Oct 28 12:42 - 12:42 (00:00) .... No idea who pD9E42DCC.dip.t- is. But I've seen various connection attempts from various hosts and realize sometimes it's just normal probing. Could the one right before the reboot just be a coincidence? Earlier I realized that SuSE has an ftp user set up by default(!), but enabling ftpd was my own doing. Needless to say, I don't want anonymous ftp so I removed the `ftp' user. The system was updated/patched before the 23rd (right after 7.2 was installed) and nmap only gives me 21, 22, 37, 80, 443, and 3306 (which was/are expected..). I'm hoping I'm just being paranoid and the system is rebooting because of something else.. -Brian