I have a system with many processes and one of them looks to be invoking shutdown or something similar causing the host to exit very quickly. There is no linux kernel crash so I'm going under the assumption that there is a process that has decided it has hit some critical condition and rather than do the right thing, is bringing the box down.
Stubbing out /sbin/shutdown and reboot was one way I thought to try and catch the process that is invoking this, but it's more devious than that it seems. Another idea I had was to put a check in /etc/rc.d/rc and ignore runlevel changes to 0 or 6. Still to try that one, but: any other better ideas in trying to find out which process is invoking the shutdown?