4

Someone restarted our Linux server and I want to find out which user did it.

There might be multiple users on this server with sudo privileges, is there any specific log file which keep track of user who did reboot last time?

Edit: I am using Red Hat 6.3

  • 1
    grep -r sudo /var/log can help – hek2mgl Mar 16 '15 at 20:52
  • 1
    You can search trough lastlog, bash_history (if no sudo), /var/log/{auth.log|secure} (sudo) or audit.log if auditd is running etc. – Xavier Lucas Mar 16 '15 at 21:01
6

You can use "last" to check. It shows when was the system rebooted and who were logged-in and logged-out.

From manpage:

last, lastb - show listing of last logged in users
8

If your users have to use sudo to reboot the server then yo should be able to find who did it by looking in the relevant log file. For CentOS like distros look in /var/log/secure and for Ubuntu like look in /var/log/auth log.

If you're using a different OS or distro you could track the log file down by reading the sudoers man page which contains information about the log facility that is used by default and how to change it. Armed with that you can check your syslog config ...

3

Every Linux/unix system has a variety of /var/log/secure.

For Ubuntu, as I'm guessing you are using, try /var/log/auth.log.

I would suggest:

sudo grep sudo /var/log/auth.log

You will get results similar to:

Mar 16 13:40:38 hostname sudo:  username : TTY=pts/10 ; PWD=/home/username ; USER=root ; COMMAND=/bin/bash

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.