Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

E.g. I'm seeing this in /var/log/messages:

Mar 01 23:12:34 hostname shutdown: shutting down for system halt

Is there a way to find out what caused the shutdown? E.g. was it run from console, or someone hit power button, etc.?

share|improve this question
    
So this time a had some luck with /var/log/acpid: turned out the power button was hit. Any other ideas, where to look if acpid doesn't give a clue? –  alex Mar 21 '11 at 19:20

6 Answers 6

up vote 10 down vote accepted
+50

Only root privileged programs can gracefully shutdown a system. So when a system shuts down in a normal way, it is either a user with root privileges or an acpi script. In both cases you can find out by checking the logs. An acpi shutdown can be caused by power button press, overheating or low battery (laptop). I forgot the third reason, UPS software when power supply fails, which will send an alert anyway.

Recently I had a system that started repeatedly to power off ungracefully, turned out that it was overheating and the mobo was configured to just power off early. The system didn't have a chance to save logs, but fortunately monitoring the system's temperature showed it was starting to increase just before powering off.

So if it is a normal shutdown it will be logged, if it is an intrusion... good luck, and if it is a cold shutdown your best chance to know is to control and monitor its environment.

share|improve this answer

Try the following commands:

Display list of last reboot entries: last reboot | less

Display list of last shutdown entries: last -x | less

or more precisely: last -x | grep shutdown | less

You won't know who did it however. If you want to know who did it, you will need to add a bit of code which means you'll know next time.

I've found this resource online. It might be useful to you:

How to find out who or what halted my system

share|improve this answer
2  
Well, this doesn't tell me what caused the shutdown, only when it was done. Which I already know, see my question. –  alex Apr 5 '11 at 6:22
    
more precisely last -x shutdown –  Rahul Patil Jun 10 '13 at 5:49

I have just a clumsy idea, but maybe it works for you: enter the command last and check out the login informations for all of the users. then, filter th users with the permission required for halt that had been logged in at that moment. then check out their .bash_history file to see if they have entered halt or not.

share|improve this answer

Some possible log files to explore: (found a Ubuntu system, but I would hope that they're present on most Linux/Unix systems)

/var/log/debug
/var/log/syslog (will be pretty full and may be harder to browse)
/var/log/user.log
/var/log/kern.log
/var/log/boot

Again, these log files are present on a Ubuntu system, so filenames may be different. The tail command is your friend.

share|improve this answer

Simplify using last displaying the system shutdown entries and run level changes and filtering on shutdown and reboot:

last -x shutdown reboot
share|improve this answer
    
ndefontenay already mentioned that. Thank you for contributing, but please read the existing answers first. –  Gilles Dec 23 '13 at 15:30
    
I though my answer simplified ndefontenay one, but thanks. –  jhvaras Dec 23 '13 at 16:15
    
@gilles I gotta say this is subtly different, in the cat foo | grep bar vs grep bar foo sort of way, it appears that last is capable of filtering itself. –  xenoterracide Dec 26 '13 at 18:41

alias the shutdown to a script
the script must give all the parameters, etc to the original shutdown executable
BUT: the script must log those this

share|improve this answer
1  
The shutdown script does this already (last -x) –  forcefsck Apr 2 '11 at 21:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.