server rebooted

manoj.solaris · January 28, 2009, 6:19am

Hi,

I want to know how to find out which user has rebooted the server? I have used last command but it is not giving username though it is showing below output

reboot --------------- date

Regards,

Manoj

zaxxon · January 28, 2009, 8:56am

Reboots are documented in the errpt. You can be lucky and find with errpt -a which uid issued the reboot.

manoj.solaris · January 28, 2009, 12:11pm

Thanks Zaxxon.

bakunin · January 29, 2009, 10:10am

The reboot can only be issued by root, nobody else has that privilege. Therefore you will have to search for the last one who changed to root (via "su", etc.), this would be some evidence.

I hope this helps.

bakunin

funksen · January 29, 2009, 10:54am

reboot should work for everyone in the shutdown group too, since reboot hast root sticky bit set per default

bakunin · January 29, 2009, 6:42pm

Oops, funksen is right. I stand corrected. Usually (my experience), though, root is the only member in the shutdown group.

bakunin