LinuxQuestions.org - [SOLVED] server restart check

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - server restart check (https://www.linuxquestions.org/questions/linux-newbie-8/server-restart-check-4175505416/)

server restart check

Hi,

I am using centos 6 x86. How can i check who restarted server and at what time. i am getting

Code:

[root@swift ~]# who -b

        system boot  2014-05-19 05:40

And

Code:

[root@swift ~]# last reboot

reboot  system boot  2.6.32-358.el6.x Mon May 19 05:40 - 07:49  (02:09)    

reboot  system boot  2.6.32-358.el6.x Wed Apr  2 06:47 - 07:49 (47+01:02)  

reboot  system boot  2.6.32-358.el6.x Fri Feb 28 16:06 - 07:49 (79+14:43)

Could any one help me to explain it and dig into it more.

the last reboot command is ok, you need to know who executed that. Probably it was executed as root, therefore you need to know who was logged in as root that time...

Quote:

Originally Posted by pan64 (Post 5173428)

the last reboot command is ok, you need to know who executed that. Probably it was executed as root, therefore you need to know who was logged in as root that time...

How to know who logged in as root and at what time it was restated? could you explain above given outputs.

no, I'm really sorry, but that information is not enough. First you need to check the command last again: who was logged in at all that time

Quote:

Originally Posted by pan64 (Post 5173433)

no, I'm really sorry, but that information is not enough. First you need to check the command last again: who was logged in at all that time

Code:

[root@swift ~]# last |more

root    pts/2        gaidl-5015.gai.n Mon May 19 07:42  still logged in  

sachin.d pts/2        gaidl-5015.gai.n Mon May 19 07:40 - 07:42  (00:01)    

root    pts/2        gaidl-5015.gai.n Mon May 19 07:40 - 07:40  (00:00)    

rajkumar pts/1        tugelanew.gai.ne Mon May 19 07:31  still logged in  

sathish. pts/0        tugelanew.gai.ne Mon May 19 07:10  still logged in  

root    pts/0        192.168.0.102    Mon May 19 06:34 - 06:37  (00:03)    

root    pts/0        192.168.0.102    Mon May 19 06:27 - 06:32  (00:04)    

root    pts/1        tugelanew.gai.ne Mon May 19 06:18 - 06:23  (00:05)    

root    pts/0        192.168.0.102    Mon May 19 06:17 - 06:22  (00:04)    

root    pts/2        tugelanew.gai.ne Mon May 19 06:13 - 06:16  (00:03)    

root    pts/1        192.168.0.102    Mon May 19 06:11 - 06:16  (00:05)    

root    pts/0        tugelanew.gai.ne Mon May 19 06:11 - 06:16  (00:05)    

root    pts/0        192.168.0.102    Mon May 19 06:11 - 06:11  (00:00)    

root    pts/0        192.168.0.102    Mon May 19 06:09 - 06:10  (00:00)    

reboot  system boot  2.6.32-358.el6.x Mon May 19 05:40 - 08:31  (02:51)    

rajkumar pts/0        tugelanew.gai.ne Mon May 19 05:17 - crash  (00:23)    

saidha.r pts/0        tugelanew.gai.ne Fri May 16 16:44 - 17:40  (00:56)    

rajkumar pts/9        tugelanew.gai.ne Fri May 16 12:46 - 13:30  (00:43)    

saidha.r pts/7        tugelanew.gai.ne Fri May 16 12:16 - 18:18  (06:02)    

saidha.r pts/9        192.168.3.3      Fri May 16 11:39 - 11:39  (00:00)    

root    pts/8        gaidl-5015.gai.n Fri May 16 11:35 - 13:43  (02:08)

Whan i ran "last" command, i got above output.

So you can see there was only one user logged in before reboot, rajkumar. You can ask him/her if he/she knew something about that reboot. You can also check the files /var/log/auth.log, /var/log/messages, probably you can find something related.