How to know the which user reboot Linux server?

[gdr · Accepted solution]

Hello, 

To reboot a system is needed a privileged user.

It's possible to collect information from different source.

with the command last, you can see who was logged in the system and when the server was rebooted.

$ last

Addiitonal information with:

$ man last

If the reboot was performed with a sudo user, and you have the journalctl persistent storage enabled on the system, with the journalctl you can find the entry:

$ journalctl |grep reboot

Jul 28 06:59:48 rhel86 sudo[1816]: admin : TTY=pts/0 ; PWD=/var/log ; USER=root ; COMMAND=/bin/systemctl reboot

In the entry there are information about the reboot phases.

Best regards

[Stephen_Adams · Accepted solution]

word. As typical in all linux, there are multiple ways to do anything and almost everything. Great job outlining multiple solutions.

[Ksahil]

I m new to Linux. you had given a great solution I learned new stuff or command because of you. Thank you so much !!

[Armann]

Awesome, I didn't know about the last command. Always learning something new!