I want to monitor whenever any of our machines run the shutdown command so that it can send an email or notification of an imminent reboot/shutdown. I figured that when shutdown was run it probably relayed the broadcast message to syslog, but I don't see it being stored in any of the logs. Is there a way to log whenever this command is run?
 For clarification, by when the shutdown command is run, I mean when it starts running (or when it first broadcasts about the shutdown) NOT when the shutdown of the system actually starts. So I want to be able to catch when it sends this type of message: The system is going down for reboot in 5 minutes!