3

I have a Ubuntu installation where multiple users have desktop sessions at the same time, some over XRDP and another directly on VT7. How can I find out which of these users initiated a shutdown or reboot, e.g by the XRDP mechanism

XRDP SESSION

or by the systray popup menu?

TTY7 SESSION

For example:

Like in Windows system in event viewer I can see which user did restart or shutdown by that the user click on button in each session even in RDP so the same I search to do for Linux system

None of the users will use the command-line to perform shutdown or restart.

Improve this question
3
  • Hi, and welcome to the site. I took the liberty to rephrase the question to make it easier to understand for contributors. If you feel the edit has gone against your original intentions, feel free to roll back. Commented Nov 5, 2024 at 12:07
  • @AdminBee I appreciate your help, But still in the process of powering off or restarting the PC I need to see how can be written on the log the user initiated it because after system comes up I check this, I will give example to describe better what I search for Commented Nov 5, 2024 at 12:53
  • XY bryh! Failing that: see sudo logs. Commented Nov 7, 2024 at 9:16

2 Answers 2

Reset to default
0

You're welcome to implement the feature yourself, currently it doesn't exist.

I filed a feature request more than a year ago:

https://github.com/systemd/systemd/issues/27847

Actually it's actively been worked on but it's yet to be merged:

https://github.com/systemd/systemd/pull/28579

You can grab the patchset and apply it to your system in case you don't want to wait for months/years before it reaches your distro.

Improve this answer
2
  • Yes I see you requested, also please request for XRDP because there also have buttons of shutdown and reboot Commented Nov 5, 2024 at 13:10
  • XRDP will work as well regardless because it's just a session, so the PID will be logged and that should be enough to establish the user. Commented Nov 5, 2024 at 13:32
0

In openSUSE LEap 15.5 I found these after having powered off the system via GNOME menu:

polkitd[1721]: Operator of unix-session:2 successfully authenticated as unix-user:root to gain TEMPORARY authorization for action org.freedesktop.login1.power-off for system-bus-name::1.65 [/usr/lib/gnome-session-binary --systemd-service --session=gnome] (owned by unix-user:windl)
...
systemd-logind[1826]: System is powering down.

See the "owned by unix-user:" part.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.