Who turned on my Ubuntu box?

Question

I have turned off my Ubuntu PC with sudo poweroff. After several days I found it is running back. How to know, which event turned it on?

Computer has no keyboard and mouse attached, and power button is blocked.

Is there a systematic way to know the reason of power on in Ubuntu?

If it is network, then how to trace packets, being able to turn computer on?

if you suspect WOL, then you could monitor the LAN with another computer .... use an ethernet hub so that you can monitor the traffic between your PC and LAN ...... i don't even know if you can buy a hub any more — jsotola, Mar 16 '19 at 04:47

Jakub Lucký · Answer 1 · 2019-03-16T08:39:49.837

2

It might be worth mentioning your hardware (there are ways to make HW wake up after some time through BIOS/EFI).

You can disable Wake-on-LAN, both in BIOS/EFI or in Linux: How to disable Wake on Lan. Catching Wake-on-LAN packets might be possible, but definitely not easy.

To monitor Wake On Lan packets, you can capture them using another computer on the network (as WoL is sent to broadcast) with tshark -i wlan0 -w outfile.pcap -p 'ether proto 0x0842 or udp port 9' Afterwards, you can load the capture file in Wireshark, where you can see MAC address of the sender.

edited Mar 16 '19 at 08:39

answered Mar 15 '19 at 19:13

Jakub Lucký

742
3
11

1

I don't want to disable WOL, I am utilizing it. I just want to know what is going on. – Dims Mar 15 '19 at 19:22
1

@Dims That is not something you have mentioned in your question. I added monitoring WOL to my updated answer – Jakub Lucký Mar 16 '19 at 08:37

score 2 · Answer 2 · answered Mar 15 '19 at 20:03

2

Some BIOSes have a setting to boot up after a power failure, which is useful to boot a kiosk computer, a server, or a PC where the power button is disabled on purpose or by failure.

An otherwise unnoticed short power outage may then have caused an unwanted boot.

answered Mar 15 '19 at 20:03

Takkat

146
6

1

So, how to detect if it was this? – Dims Mar 16 '19 at 08:47
1

The obvious test would be to simulate a power failure by unplugging your machine, but **this is not recommended**. It may lead to data loss. The BIOS should have an option for this somewhere. My Asrock BIOS has this as "Restore on Power Loss > Power ON" in the "Advanced" tab. You BIOS may have a different name for that. – Takkat Mar 16 '19 at 09:08

score 1 · Answer 3 · answered Mar 15 '19 at 21:40

I had this issue on a Dell Optiplex and the problem turned out to be a wake-on-a-schedule feature in the BIOS, not wake-on-lan. It was set to boot my machine every morning. You can read more about this feature here: http://www.inspectmygadget.com/2009/01/08/little-known-bios-features-wake-up-a-computer-on-a-schedule and here https://www.makeuseof.com/answers/bios-computer-boot-specific-time/.

Who turned on my Ubuntu box?

3 Answers3