Find informs. about executing shutdown..

[Janghyegyung]

Suddenly the server was shutdowned by someone.
By errpt command, I checked out the logging about "system shutdown by user".

Can I get the user-id, or anything like that about this situation? I want to know who shutdowned the server..

 

[PSD]

Jang,

Well this is a tricky one. Do you use SUDO or would the user have to have su'd to root to shut down the system.

I would check the time of the reboot:

who -b

Then look in wtmp for anyone who may logged in around that time:

who /var/adm/wtmp

Then look at the sulog to see who su'd around this time:

view /var/adm/sulog

Also, If you find any offending users it may be worth looking in their home directories at the .sh_history file, if they did not do an su -, then the shutdown command may have been recorded in here.

Cheers PSD
IBM Certified Specialist - AIX V4.3 Systems Support
IBM Certified Specialist - AIX V4 HACMP

 

[aixmurderer]

If you do a errpt -a to look at the errorlog you should see the userid listed, see extract below, this sample was a cron job:

Description
SYSTEM SHUTDOWN BY USER

Probable Causes
SYSTEM SHUTDOWN

Detail Data
USER ID
0
0=SOFT IPL 1=HALT 2=TIME REBOOT
0

From there on you could possibly use the "who" commands as suggested by PSD, or even the last command should give you an idea too.
IBM Certified Specialist - MQSeries

 

[aixnag]

i think this will help you,


look at /var/adm/wtmp with # last command
# last |grep shutdown |more
look for the day and time the shutdown occured along with user id.

check for /var/adm/sulog to see the su log.
#cat /var/adm/sulog

nagaraj