Originally Posted by sachin.davra
i want to know when my pc went turned off and who did it and when it was turned on. i am using centos 6. i used last command with -x. here is the output.
root pts/1 alps.gai.net Thu Jan 16 16:53 still logged in
root pts/2 192.168.50.32 Thu Jan 16 16:49 still logged in
root pts/1 alps.gai.net Thu Jan 16 14:55 - 16:50 (01:54)
root pts/1 alps.gai.net Thu Jan 16 14:45 - 14:54 (00:09)
root pts/0 192.168.50.32 Thu Jan 16 12:14 still logged in
runlevel (to lvl 5) 2.6.32-279.14.1. Thu Jan 16 04:52 - 17:03 (12:10)
reboot system boot 2.6.32-279.14.1. Thu Jan 16 04:52 - 17:03 (12:10)
root pts/0 192.168.50.32 Wed Jan 15 14:59 - 15:31 (00:32)
root pts/1 192.168.50.32 Mon Jan 13 16:10 - 16:17 (00:06)
root pts/0 alps.gai.net Mon Jan 13 15:34 - 20:32 (04:58)
root pts/0 alps.gai.net Mon Jan 13 12:13 - 13:29 (01:16)
Ok, so it's telling you that the system booted. Did you try to check ANY of the log files? User histories? Typing "last" won't tell you anything about why the system rebooted. And EVERYONE logs in as root, even over the network?? That is a VERY BAD THING
...network root logins should be disabled, and the ONLY place root should be able to log in, is on the system console. Everyone else has to log in as themselves, and they can sudo/su as needed. If your systems administrator had followed ANY of the very basic system security basics, you'd know WHO logged in, and can go from there.