On a redhat production box someone just ran shutdown and I need to find the log file that specifically shows which user ran the "shutdown" command (and when would be nice).
Only root can run shutdown, hence that user was root.
Hopefully you enforce the use of
sudo to run root commands. In that case, look in
/var/log/secure to find out who did
Depending on how the command was executed, this can be a bit tricksome.
- Check your sudo logs, they are using sudo right?!?
- If run directly as root, see who else was logged in at the same time. Using the wtmp file through the
lastcommand may be helpful.
- If they remotely logged in as root, check, again using
lastwhich address they logged in from and who was using that system at that time. Also, fix this so they can't log in remotely as root.
- If logged in through the console, check your access logs to see who had physical access to the system at the time.
Hopefully not too many admins are logged in at the same time as root.