when linux was turned on and when it went shutdown

sachin.davra · 01-16-2014, 05:33 AM

i want to know when my pc went turned off and who did it and when it was turned on. i am using centos 6. i used last command with -x. here is the output.

Code:

last -x
root     pts/1        alps.gai.net     Thu Jan 16 16:53   still logged in   
root     pts/2        192.168.50.32    Thu Jan 16 16:49   still logged in   
root     pts/1        alps.gai.net     Thu Jan 16 14:55 - 16:50  (01:54)    
root     pts/1        alps.gai.net     Thu Jan 16 14:45 - 14:54  (00:09)    
root     pts/0        192.168.50.32    Thu Jan 16 12:14   still logged in   
runlevel (to lvl 5)   2.6.32-279.14.1. Thu Jan 16 04:52 - 17:03  (12:10)    
reboot   system boot  2.6.32-279.14.1. Thu Jan 16 04:52 - 17:03  (12:10)    
root     pts/0        192.168.50.32    Wed Jan 15 14:59 - 15:31  (00:32)    
root     pts/1        192.168.50.32    Mon Jan 13 16:10 - 16:17  (00:06)    
root     pts/0        alps.gai.net     Mon Jan 13 15:34 - 20:32  (04:58)    
root     pts/0        alps.gai.net     Mon Jan 13 12:13 - 13:29  (01:16)

smallpond · 01-16-2014, 08:57 AM

What cron job ran around 4am? Are you running a different kernel than you were yesterday?
Do you have an automatic update script that runs?

TB0ne · 01-16-2014, 09:31 AM

Quote:

Originally Posted by sachin.davra

i want to know when my pc went turned off and who did it and when it was turned on. i am using centos 6. i used last command with -x. here is the output.

Code:

last -x
root     pts/1        alps.gai.net     Thu Jan 16 16:53   still logged in   
root     pts/2        192.168.50.32    Thu Jan 16 16:49   still logged in   
root     pts/1        alps.gai.net     Thu Jan 16 14:55 - 16:50  (01:54)    
root     pts/1        alps.gai.net     Thu Jan 16 14:45 - 14:54  (00:09)    
root     pts/0        192.168.50.32    Thu Jan 16 12:14   still logged in   
runlevel (to lvl 5)   2.6.32-279.14.1. Thu Jan 16 04:52 - 17:03  (12:10)    
reboot   system boot  2.6.32-279.14.1. Thu Jan 16 04:52 - 17:03  (12:10)    
root     pts/0        192.168.50.32    Wed Jan 15 14:59 - 15:31  (00:32)    
root     pts/1        192.168.50.32    Mon Jan 13 16:10 - 16:17  (00:06)    
root     pts/0        alps.gai.net     Mon Jan 13 15:34 - 20:32  (04:58)    
root     pts/0        alps.gai.net     Mon Jan 13 12:13 - 13:29  (01:16)

Ok, so it's telling you that the system booted. Did you try to check ANY of the log files? User histories? Typing "last" won't tell you anything about why the system rebooted. And EVERYONE logs in as root, even over the network?? That is a VERY BAD THING...network root logins should be disabled, and the ONLY place root should be able to log in, is on the system console. Everyone else has to log in as themselves, and they can sudo/su as needed. If your systems administrator had followed ANY of the very basic system security basics, you'd know WHO logged in, and can go from there.