E.g. I'm seeing this in
Mar 01 23:12:34 hostname shutdown: shutting down for system halt
Is there a way to find out what caused the shutdown? E.g. was it run from console, or someone hit power button, etc.?
Only root privileged programs can gracefully shutdown a system. So when a system shuts down in a normal way, it is either a user with root privileges or an acpi script. In both cases you can find out by checking the logs. An acpi shutdown can be caused by power button press, overheating or low battery (laptop). I forgot the third reason, UPS software when power supply fails, which will send an alert anyway.
Recently I had a system that started repeatedly to power off ungracefully, turned out that it was overheating and the mobo was configured to just power off early. The system didn't have a chance to save logs, but fortunately monitoring the system's temperature showed it was starting to increase just before powering off.
So if it is a normal shutdown it will be logged, if it is an intrusion... good luck, and if it is a cold shutdown your best chance to know is to control and monitor its environment.
Try the following commands:
Display list of last reboot entries:
Display list of last shutdown entries:
or more precisely:
You won't know who did it however. If you want to know who did it, you will need to add a bit of code which means you'll know next time.
I've found this resource online. It might be useful to you:
I have just a clumsy idea, but maybe it works for you:
enter the command
Some possible log files to explore: (found a Ubuntu system, but I would hope that they're present on most Linux/Unix systems)
Again, these log files are present on a Ubuntu system, so filenames may be different. The
Not fully satisfying
I had a similar need on a Debian 7.8 and observe that basically there's no clear and explicit message in log, which is a little surprising.
The other solutions mentioned (
Looking how it works
if [ -x /etc/acpi/powerbtn.sh ] ; then # Compatibility with old config script from acpid package /etc/acpi/powerbtn.sh elif [ -x /etc/acpi/powerbtn.sh.dpkg-bak ] ; then # Compatibility with old config script from acpid package # which is still around because it was changed by the admin /etc/acpi/powerbtn.sh.dpkg-bak else # Normal handling. /sbin/shutdown -h -P now "Power button pressed" fi
Notice that an explicit text is given as parameter of the
Adjusting for better logs
Anyway, to get an explicit message I put the text below (as root) in a newly created
#!/bin/sh logger in /etc/acpi/powerbtn.sh, presumably "Power button pressed" /sbin/shutdown -h -P now "Power button pressed"
Doing it this way will probably make a longer lasting change than modifying
Notice than Ubuntu 14.04 does it differently (
And now when the power button is pressed, a line like below appears in
Now that's an explicit message in the log.
alias the shutdown to a script