Here is what I found in the audit log: on Centos 7: type=SERVICE_START msg=audit(06/25/2020 15:24:18.967:80755) : pid=1 uid=root auid=unset ses=unset msg='unit=systemd-shutdownd comm=systemd exe=/usr/lib/systemd/systemd hostname=? addr=? terminal=? res=success' type=SYSTEM_RUNLEVEL msg=audit(06/25/2020 15:25:19.501:103256) : user pid=12951 uid=root auid=unset ses=unset msg='old-level=3 new-level=0 exe=/sbin/shutdown hostname=? addr=? terminal=? res=success' ---- type=SYSTEM_SHUTDOWN msg=audit(06/25/2020 15:25:19.501:103257) : user pid=12951 uid=root auid=unset ses=unset msg='init exe=/sbin/shutdown hostname=? addr=? terminal=? res=success'
============================================================= on Centos 6: [root@aries ~]# ausearch -i -p 12951 ---- type=USER_AUTH msg=audit(05/23/2020 20:23:44.890:8878) : user pid=12951 uid=ovirtagent auid=unset ses=unset msg='op=PAM:authentication acct=ovirtagent exe=/usr/sbin/userhelper hostname=? addr=? terminal=? res=success' ---- type=USER_ACCT msg=audit(05/23/2020 20:23:44.891:8879) : user pid=12951 uid=ovirtagent auid=unset ses=unset msg='op=PAM:accounting acct=ovirtagent exe=/usr/sbin/userhelper hostname=? addr=? terminal=? res=success' ---- type=SYSTEM_RUNLEVEL msg=audit(06/25/2020 15:25:19.501:103256) : user pid=12951 uid=root auid=unset ses=unset msg='old-level=3 new-level=0 exe=/sbin/shutdown hostname=? addr=? terminal=? res=success' ---- type=SYSTEM_SHUTDOWN msg=audit(06/25/2020 15:25:19.501:103257) : user pid=12951 uid=root auid=unset ses=unset msg='init exe=/sbin/shutdown hostname=? addr=? terminal=? res=success' ---- _______________________________________________ Users mailing list -- users@ovirt.org To unsubscribe send an email to users-le...@ovirt.org Privacy Statement: https://www.ovirt.org/privacy-policy.html oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ List Archives: https://lists.ovirt.org/archives/list/users@ovirt.org/message/5J4DHQI4HI6JAI2HUIZVZIHPC3ZFT5LH/
