Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to monitor whenever any of our machines run the shutdown command so that it can send an email or notification of an imminent reboot/shutdown. I figured that when shutdown was run it probably relayed the broadcast message to syslog, but I don't see it being stored in any of the logs. Is there a way to log whenever this command is run?

[edit] For clarification, by when the shutdown command is run, I mean when it starts running (or when it first broadcasts about the shutdown) NOT when the shutdown of the system actually starts. So I want to be able to catch when it sends this type of message: The system is going down for reboot in 5 minutes!

share|improve this question
    
What about change reboot to you own script with emailing etc . cat > /sbin/reboot #!/bin/sh mail ...... halt ^D –  Korjavin Ivan Sep 22 '11 at 22:09
    
What specific Linux OS are you using? I'm pretty sure this can be done using Upstart, but that is only included with RHEL6, newer versions of Ubuntu, etc. –  Stefan Lasiewski Sep 22 '11 at 22:10
    
Red Hat Enterprise Linux 6 –  Andrew Case Sep 22 '11 at 23:29
add comment

3 Answers

up vote 3 down vote accepted

If you want to monitor shutdown command only:

  • you can wrap it in a shell script that sends the email
  • you can use a preloaded library that logs the command like snoopy logger
  • you can use systemtap to record all exec*() for shutdown.

The problem is that you will have no record if someone just press the reset button. For this the reliable way is to do the logging in the startup of the machine.

Please note the last log is creating an entry at the startup of the machine.

It is possible to have an out of band recording using BMC/LOM/IPMI. You can use this if your motherboard has a BMC integrated, or you have installed a BMC as an extension card.

share|improve this answer
add comment

You can modify syslog.conf to trap this messages.

for example, if you have standard syslog then line

 *.*   /var/log/all.log

store all messages.

If you have rsyslog (modern debian for example) you can start some script (send email etc) on event

share|improve this answer
    
Doesn't work. I use rsyslog, but the shutdown command doesn't seem to get sent to syslog so rsyslog doesn't pick it up (other messages are logged fine). –  Andrew Case Sep 22 '11 at 21:15
1  
$LogRSyslogStatusMessages [on/off] - If set to on (the default), rsyslog emits message on startup and shutdown i mean, if rsyslog not saw kernel message, it was shudowned himself, so lets see when rsyslog was switchoff –  Korjavin Ivan Sep 22 '11 at 21:23
    
I use freebsd mostly, and always see something like 'date rebooted by username ' in all.log my be in linux its work different –  Korjavin Ivan Sep 22 '11 at 21:25
    
Doesn't look like it's a feature of my version 4.6.2, looks like it got added in 4.7: git.adiscon.com/… :( –  Andrew Case Sep 22 '11 at 21:36
    
It could be I just don't have the right input modules loaded. What im's do you have? –  Andrew Case Sep 22 '11 at 21:40
show 1 more comment

I have found no way to send a notification upon shutdown (On RedHat). And keep in mind:

  • email which is sent own during a shutdown is likely to remain in the mail queue until the system comes back online
  • In the event of a power outage, any actions which happen during shutdown will not happen. In this case, you're better off doing something during the startup process instead.

But you can perform actions upon startup using cron, using the @reboot "nickname".

So, if the script /usr/local/bin/email-on-reboot.sh sends an email/notification about the startup, add this to /etc/crontab:

@reboot  /usr/local/bin/email-on-reboot.sh
share|improve this answer
    
its works AFTER reboot –  Korjavin Ivan Sep 22 '11 at 20:58
    
interesting, but not helpful. I want notification before the reboot so that if it's unexpected the reboot can be cancelled. –  Andrew Case Sep 22 '11 at 21:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.