Source of Shutdown?

[mhammett]

We had a server that shutdown yesterday. I do mean shutdown and not powered off.

In the "Task History" for that host, I do see a "Stop all VMs and Containers" entry. Is there any way to see *how* that shutdown was requested? Was a button clicked in the web UI? A command entered in the CLI?

 

[Stoiko Ivanov]

usually this is logged in the journal/syslog (before the shutdown sequence starts)

if `journalctl -b -1` yields output this is the log for the last boot of the system (until it shut down) - go to the end of the text and then search upward for 'shutdown'
If it does not produce output you can check /var/log/syslog.1 (or .2.gz and so on) for the logs.

I hope this helps!