Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a redhat production box someone just ran shutdown and I need to find the log file that specifically shows which user ran the "shutdown" command (and when would be nice).

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

Only root can run shutdown, hence that user was root.

Hopefully you enforce the use of sudo to run root commands. In that case, look in /var/log/secure to find out who did sudo shutdown.

share|improve this answer
add comment

Depending on how the command was executed, this can be a bit tricksome.

  1. Check your sudo logs, they are using sudo right?!?
  2. If run directly as root, see who else was logged in at the same time. Using the wtmp file through the last command may be helpful.
  3. If they remotely logged in as root, check, again using last which address they logged in from and who was using that system at that time. Also, fix this so they can't log in remotely as root.
  4. If logged in through the console, check your access logs to see who had physical access to the system at the time.
share|improve this answer
    
All of those options kind of work, but are really hard when there are 10+ people logged in. I'm hoping there is a clear log of " this user ran shutdown at this time" type of thing. –  Dan Grec Nov 22 '11 at 19:54
add comment

last|head

Hopefully not too many admins are logged in at the same time as root.

share|improve this answer
    
Lots of people logged in –  Dan Grec Nov 22 '11 at 19:54
    
Directly as root, just before the shutdown? –  Nils Nov 22 '11 at 20:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.