Shutdown Trace

[Ricky_2]

Hi, I've a 10.20 system that was rebooted twice a couple of days ago. I'm trying to find out who rebooted it. The wtmp didn't show anyone logging in and btmp also didn't show any failed login attempts during that period. The only activity was logged in sulog where someone su-ed successfully from root to oracle on terminal tty??. I have "console" in /etc/securetty. Can someone tell me what tty?? meant and is there any other trace that I can looked at? /sbin/shutdown has permission 4555, is that correct? Won't it mean that anyone can shutdown the machine? Thanks.

[Olav Baadsvik]

Hello,

Check the file /etc/shutdown.log

Also check the file /etc/shutdown.allow to
see if users other than root are give the
permission to shutdown the machine.

Olav

[Olav Baadsvik]

Hi again.

Sorry, the name of the file is
/etc/shutdownlog

Olav

[Ricky_2]

Hi Olav, thanks for the reply. /etc/shutdown.allow is a zero length file, so I assume only root is allowed to shutdown. /var/adm/shutdownlog only managed to log the shutdown date and time. There's not much info there too.

[Bill McNAMARA_1]

try the last command to identify who was logged in.

[Bill McNAMARA_1]

does the /var/adm/syslog/syslog.log not tell you who su'd to root?

[Ricky_2]

Hi Bill, thanks for the reply. Nope, "last" does not show any user logging into the system immediately before the shutdown. syslog.log was overwritten because the system was rebooted twice. Do you think that root access was gained from hard resetting the system, thereby explaining why no logins were captured in wtmp? Thanks.

[Decio Miname]

Looks like someone is playing games with you...
This could help in some environments, you have to check if that is your case. Check the change date/time of the users' history files (typically .sh_history). That would give you an idea of who was on at that time. Probably you have to check that on backups, because anyone that has logged in since then have now a newer date/time on its history file.
This is not the best way to look for what you want, but it is better than nothing since the "right" files provided no useful information.
BTW, I've added a startup script on all my servers to save the OLDsyslog.log file at system startup time. For many cases, two reboots is a small number to miss the syslog information.