On a redhat production box someone just ran shutdown and I need to find the log file that specifically shows which user ran the "shutdown" command (and when would be nice).


Only root can run shutdown, hence that user was root.

Hopefully you enforce the use of sudo to run root commands. In that case, look in /var/log/secure to find out who did sudo shutdown.


Depending on how the command was executed, this can be a bit tricksome.

  1. Check your sudo logs, they are using sudo right?!?
  2. If run directly as root, see who else was logged in at the same time. Using the wtmp file through the last command may be helpful.
  3. If they remotely logged in as root, check, again using last which address they logged in from and who was using that system at that time. Also, fix this so they can't log in remotely as root.
  4. If logged in through the console, check your access logs to see who had physical access to the system at the time.
  • All of those options kind of work, but are really hard when there are 10+ people logged in. I'm hoping there is a clear log of " this user ran shutdown at this time" type of thing. – Dan Grec Nov 22 '11 at 19:54


Hopefully not too many admins are logged in at the same time as root.

  • Lots of people logged in – Dan Grec Nov 22 '11 at 19:54
  • Directly as root, just before the shutdown? – Nils Nov 22 '11 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.