is it possible to find out ip address of user who has shutdown or rebooted the server , I have used the command errpt -a , in that it is showing server rebooted but it is not showing ip address who has shutdown the serve, even I have used command last reboot.
1. Checking the shutdown time:
-bash-3.00$ last shutdown
wtmp begins Feb 28 11:01
2. Checking the on line people who has the access to shutdown server at that time.
You can use # last username and # last to limit it.
3. Checking user history or asking them what they did at that time.