Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a redhat production box someone just ran shutdown and I need to find the log file that specifically shows which user ran the "shutdown" command (and when would be nice).

share|improve this question
up vote 2 down vote accepted

Only root can run shutdown, hence that user was root.

Hopefully you enforce the use of sudo to run root commands. In that case, look in /var/log/secure to find out who did sudo shutdown.

share|improve this answer

Depending on how the command was executed, this can be a bit tricksome.

  1. Check your sudo logs, they are using sudo right?!?
  2. If run directly as root, see who else was logged in at the same time. Using the wtmp file through the last command may be helpful.
  3. If they remotely logged in as root, check, again using last which address they logged in from and who was using that system at that time. Also, fix this so they can't log in remotely as root.
  4. If logged in through the console, check your access logs to see who had physical access to the system at the time.
share|improve this answer
All of those options kind of work, but are really hard when there are 10+ people logged in. I'm hoping there is a clear log of " this user ran shutdown at this time" type of thing. – Dan Grec Nov 22 '11 at 19:54


Hopefully not too many admins are logged in at the same time as root.

share|improve this answer
Lots of people logged in – Dan Grec Nov 22 '11 at 19:54
Directly as root, just before the shutdown? – Nils Nov 22 '11 at 20:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.