Solaris

Hi,

Not sure if this was asked in a tread already(searched but did not find anything )

I want to know who rebooted a system without reading through allot of /var/adm/messages

I know the command last will show me when the system was rebooted

*user* *Login Protocol* *IP address* Fri Apr 16 10:12 - down (01:52)
reboot system boot Fri Apr 16 10:08

But for instance who issued the reboot command ?

will

*user* *Login Protocol* *IP address* Fri Apr 16 10:12 - down (01:52)

this indicate that the host was downed by this user ?

Some help plox

check the /var/log/sulog file, from there you will know who did su - as root before he/she did a reboot. You can somewhat get the timing from there if you're lucky. Also look at the messages, check if its a panic(any coredumps?? under /var/crash/hostname)..
dmesg can show you some clues too. Check your audits.. history files of user under their home directories eg .bash_history
check if there is any init or reboot commands in there

Thanks for this info, this is more clearer now