Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #1025

Re: who issued the shutdown command?

Show all headers | View raw

Lew Pitcher <lpitcher@teksavvy.com> wrote:
> shutdown could have been run by a cron job or an at job, or in response
> to the power button or a keyboard control sequence (<ctrl><alt><del>

> There may be ways to determine who ran shutdown in those cases, but
> I don't know them offhand.

1. Use of cron and at is logged. On my Debian system, the commands
executed by cron are logged in /var/log/syslog, and the fact that cron
and/or atd has run a job is captured in /var/log/auth.log.

2. For physical access to the server, I'd go with asking around, or
possibly checking the security logs for the server room door lock.

Chris

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

who issued the shutdown command? Todd <Todd@invalid.com> - 2011-05-04 13:32 -0700
  Re: who issued the shutdown command? Lew Pitcher <lpitcher@teksavvy.com> - 2011-05-04 16:41 -0400
    Re: who issued the shutdown command? Chris Davies <chris-usenet@roaima.co.uk> - 2011-05-04 23:40 +0100
      Re: who issued the shutdown command? Keith Keller <kkeller-usenet@wombat.san-francisco.ca.us> - 2011-05-04 17:03 -0700
  Re: who issued the shutdown command? unruh <unruh@wormhole.physics.ubc.ca> - 2011-05-04 22:36 +0000
  Re: who issued the shutdown command? DenverD <spam.trap@SOMEwhere.dk> - 2011-05-06 14:21 +0200
    Re: who issued the shutdown command? Balwinder S Dheeman <bsd.SANSPAM@anu.homelinux.net> - 2011-05-06 20:01 +0530
      Re: who issued the shutdown command? Michael Black <et472@ncf.ca> - 2011-05-06 10:48 -0400
        Re: who issued the shutdown command? The Natural Philosopher <tnp@invalid.invalid> - 2011-05-06 16:28 +0100
        Re: who issued the shutdown command? unruh <unruh@wormhole.physics.ubc.ca> - 2011-05-06 16:54 +0000
          Re: who issued the shutdown command? Todd <Todd@invalid.com> - 2011-05-06 13:53 -0700
          Re: who issued the shutdown command? Robert Riches <spamtrap42@jacob21819.net> - 2011-05-07 03:24 +0000
          Re: who issued the shutdown command? GangGreene <GangGreene@invalid.com> - 2011-05-07 15:43 -0400

csiph-web