How to find out who rebooted LINUX server

You can use "last" to check. It shows when was the system rebooted and who were logged-in and logged-out.

From manpage:

last, lastb - show listing of last logged in users

If your users have to use sudo to reboot the server then yo should be able to find who did it by looking in the relevant log file. For CentOS like distros look in /var/log/secure and for Ubuntu like look in /var/log/auth log.

If you're using a different OS or distro you could track the log file down by reading the sudoers man page which contains information about the log facility that is used by default and how to change it. Armed with that you can check your syslog config ...


Every Linux/unix system has a variety of /var/log/secure.

For Ubuntu, as I'm guessing you are using, try /var/log/auth.log.

I would suggest:

sudo grep sudo /var/log/auth.log

You will get results similar to:

Mar 16 13:40:38 hostname sudo:  username : TTY=pts/10 ; PWD=/home/username ; USER=root ; COMMAND=/bin/bash

Tags:

Linux

Redhat