Home / server / Questions / 314576
Accepted
Andrew Case
Asked: 2011-09-23 12:44:18 +0800 CST

Log Shutdown Command Usage/Message

  • 772

I want to monitor whenever any of our machines run the shutdown command so that it can send an email or notification of an imminent reboot/shutdown. I figured that when shutdown was run it probably relayed the broadcast message to syslog, but I don't see it being stored in any of the logs. Is there a way to log whenever this command is run?

[edit] For clarification, by when the shutdown command is run, I mean when it starts running (or when it first broadcasts about the shutdown) NOT when the shutdown of the system actually starts. So I want to be able to catch when it sends this type of message: The system is going down for reboot in 5 minutes!

linux logging syslog

3 Answers

  1. Best Answer

    If you want to monitor shutdown command only:

    • you can wrap it in a shell script that sends the email
    • you can use a preloaded library that logs the command like snoopy logger
    • you can use systemtap to record all exec*() for shutdown.

    The problem is that you will have no record if someone just press the reset button. For this the reliable way is to do the logging in the startup of the machine.

    Please note the last log is creating an entry at the startup of the machine.

    It is possible to have an out of band recording using BMC/LOM/IPMI. You can use this if your motherboard has a BMC integrated, or you have installed a BMC as an extension card.

    • 3

  2. You can modify syslog.conf to trap this messages.

    for example, if you have standard syslog then line

     *.*   /var/log/all.log

    store all messages.

    If you have rsyslog (modern debian for example) you can start some script (send email etc) on event

    • 1

  3. I have found no way to send a notification upon shutdown (On RedHat). And keep in mind:

    • email which is sent own during a shutdown is likely to remain in the mail queue until the system comes back online
    • In the event of a power outage, any actions which happen during shutdown will not happen. In this case, you're better off doing something during the startup process instead.

    But you can perform actions upon startup using cron, using the @reboot "nickname".

    So, if the script /usr/local/bin/email-on-reboot.sh sends an email/notification about the startup, add this to /etc/crontab:

    @reboot  /usr/local/bin/email-on-reboot.sh
    • 1