How to find out from the logs what caused system shutdown?

Question

E.g. I'm seeing this in /var/log/messages:

Mar 01 23:12:34 hostname shutdown: shutting down for system halt

Is there a way to find out what caused the shutdown? E.g. was it run from console, or someone hit power button, etc.?

Answer 1

Only root privileged programs can gracefully shutdown a system. So when a system shuts down in a normal way, it is either a user with root privileges or an acpi script. In both cases you can find out by checking the logs. An acpi shutdown can be caused by power button press, overheating or low battery (laptop). I forgot the third reason, UPS software when power supply fails, which will send an alert anyway.

Recently I had a system that started repeatedly to power off ungracefully, turned out that it was overheating and the mobo was configured to just power off early. The system didn't have a chance to save logs, but fortunately monitoring the system's temperature showed it was starting to increase just before powering off.

So if it is a normal shutdown it will be logged, if it is an intrusion... good luck, and if it is a cold shutdown your best chance to know is to control and monitor its environment.

Answer 2

Try the following commands:

Display list of last reboot entries: last reboot | less

Display list of last shutdown entries: last -x | less

or more precisely: last -x | grep shutdown | less

You won't know who did it however. If you want to know who did it, you will need to add a bit of code which means you'll know next time.

I've found this resource online. It might be useful to you:

How to find out who or what halted my system

Answer 3

I have just a clumsy idea, but maybe it works for you: enter the command last and check out the login informations for all of the users. then, filter th users with the permission required for halt that had been logged in at that moment. then check out their .bash_history file to see if they have entered halt or not.

Answer 4

Some possible log files to explore: (found a Ubuntu system, but I would hope that they're present on most Linux/Unix systems)

/var/log/debug
/var/log/syslog (will be pretty full and may be harder to browse)
/var/log/user.log
/var/log/kern.log
/var/log/boot

Again, these log files are present on a Ubuntu system, so filenames may be different. The tail command is your friend.

Answer 5

alias the shutdown to a script
the script must give all the parameters, etc to the original shutdown executable
BUT: the script must log those this