if the users use sudo or they su root i don't think is a way you can tell, but i think you can
do this:
add a command that looks for server uptime - if the uptime is very very low as in is just starting then you can ASSUME that is server startup and you do the logic around it.
uptime | awk '{print $3}' # prints the minutes since the host is up
If I understand correctly, your looking for 'chkconfig --list' which will list all the registered services in /etc/init.d/* . Other service commands can be started from /etc/init.d but not be added to chkconfig, from /etc/rc.local, and from /etc/inittab.
If service is
ON
inchkconfig
list, it is started by init.If service is
OFF
inchkconfig
list and service is in started state, then it is started from user level.if the users use sudo or they su root i don't think is a way you can tell, but i think you can do this:
add a command that looks for server uptime - if the uptime is very very low as in is just starting then you can ASSUME that is server startup and you do the logic around it.
If I understand correctly, your looking for 'chkconfig --list' which will list all the registered services in /etc/init.d/* . Other service commands can be started from /etc/init.d but not be added to chkconfig, from /etc/rc.local, and from /etc/inittab.