Audit Rules to Log Who Ran reboot or shutdown on Linux

Updated: 29 September 2026 · Applies to: audit 3.1 and 4.0 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

When a server reboots unexpectedly, you want to know who did it. The Linux audit system can record every run of the reboot and shutdown commands, with the user who ran them, even through sudo. One detail changed since the older CentOS 6 and 7 guides: on current systemd-based distributions, reboot, shutdown, poweroff and halt are all links to systemctl. A rule on /usr/sbin/reboot therefore records nothing; the rule must watch /usr/bin/systemctl. We tested this with audit 3.1 on AlmaLinux 9: a rule on the reboot path matched nothing, while a rule on systemctl recorded reboot, shutdown and systemctl runs, each with the name it was called by.

1. Add the rule

Install auditd if needed (dnf install audit or apt install auditd), then create /etc/audit/rules.d/50-power.rules:

-a always,exit -F arch=b64 -S execve -F path=/usr/bin/systemctl -F auid>=1000 -F auid!=unset -k power
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/systemctl -F auid=0 -k power

The rules record every run of systemctl (and so of reboot, shutdown, poweroff and halt) by users who logged in: normal users (login ID 1000 and above) and root logins. The login ID (auid) stays the same through sudo and su, so you see the real person. Services started by systemd have no login ID and are not recorded, which keeps the log small.

2. Load it

augenrules --load
auditctl -l | grep power

3. Find out who rebooted

ausearch -k power -i | grep -E "a0=(reboot|shutdown|poweroff|halt|/usr/sbin/)|a1=(reboot|poweroff|halt)"

Each match is an EXECVE line that shows the command as it was typed, for example a0=reboot or a0=systemctl a1=reboot. To see the user and time, look at the whole event: ausearch -k power -i shows the auid (the login user), uid and the time of each record.

Other places that record reboots

• last -x reboot shutdown lists reboots and shutdowns with their times (on AlmaLinux, Rocky Linux and Ubuntu 24.04; Debian 13 and Ubuntu 26.04 use wtmpdb last).
• ausearch -m SYSTEM_BOOT,SYSTEM_SHUTDOWN -i shows when the system went down and came up, from the audit log itself.
• journalctl -b -1 -n 50 shows the last messages before the previous boot.
• Commands run with sudo are also logged in /var/log/secure or /var/log/auth.log.

For more audit examples, see how to use auditd to find out who deleted a file and how to use auditd to monitor a specific system call.

Official documentation: audit.rules manual and ausearch manual.