4

I want to monitor whenever any of our machines run the shutdown command so that it can send an email or notification of an imminent reboot/shutdown. I figured that when shutdown was run it probably relayed the broadcast message to syslog, but I don't see it being stored in any of the logs. Is there a way to log whenever this command is run?

[edit] For clarification, by when the shutdown command is run, I mean when it starts running (or when it first broadcasts about the shutdown) NOT when the shutdown of the system actually starts. So I want to be able to catch when it sends this type of message: The system is going down for reboot in 5 minutes!

Andrew Case
  • 3,489
  • 3
  • 23
  • 39

3 Answers3

3

If you want to monitor shutdown command only:

  • you can wrap it in a shell script that sends the email
  • you can use a preloaded library that logs the command like snoopy logger
  • you can use systemtap to record all exec*() for shutdown.

The problem is that you will have no record if someone just press the reset button. For this the reliable way is to do the logging in the startup of the machine.

Please note the last log is creating an entry at the startup of the machine.

It is possible to have an out of band recording using BMC/LOM/IPMI. You can use this if your motherboard has a BMC integrated, or you have installed a BMC as an extension card.

Mircea Vutcovici
  • 17,619
  • 4
  • 56
  • 83
1

You can modify syslog.conf to trap this messages.

for example, if you have standard syslog then line

 *.*   /var/log/all.log

store all messages.

If you have rsyslog (modern debian for example) you can start some script (send email etc) on event

Korjavin Ivan
  • 2,250
  • 2
  • 26
  • 41
  • Doesn't work. I use rsyslog, but the shutdown command doesn't seem to get sent to syslog so rsyslog doesn't pick it up (other messages are logged fine). – Andrew Case Sep 22 '11 at 21:15
  • 1
    $LogRSyslogStatusMessages [on/off] - If set to on (the default), rsyslog emits message on startup and shutdown i mean, if rsyslog not saw kernel message, it was shudowned himself, so lets see when rsyslog was switchoff – Korjavin Ivan Sep 22 '11 at 21:23
  • I use freebsd mostly, and always see something like 'date rebooted by username ' in all.log my be in linux its work different – Korjavin Ivan Sep 22 '11 at 21:25
  • Doesn't look like it's a feature of my version 4.6.2, looks like it got added in 4.7: http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=071c9b511a711725537eff386f82a3af3ca930a8 :( – Andrew Case Sep 22 '11 at 21:36
  • It could be I just don't have the right input modules loaded. What im's do you have? – Andrew Case Sep 22 '11 at 21:40
  • let us [continue this discussion in chat](http://chat.stackexchange.com/rooms/1410/discussion-between-korjavin-ivan-and-acase) – Korjavin Ivan Sep 22 '11 at 21:50
1

I have found no way to send a notification upon shutdown (On RedHat). And keep in mind:

  • email which is sent own during a shutdown is likely to remain in the mail queue until the system comes back online
  • In the event of a power outage, any actions which happen during shutdown will not happen. In this case, you're better off doing something during the startup process instead.

But you can perform actions upon startup using cron, using the @reboot "nickname".

So, if the script /usr/local/bin/email-on-reboot.sh sends an email/notification about the startup, add this to /etc/crontab:

@reboot  /usr/local/bin/email-on-reboot.sh
Stefan Lasiewski
  • 23,667
  • 41
  • 132
  • 186