-1

I can find the entry in syslog:

Mar 29 22:15:01 raspi CRON[14533]: (root) CMD (   shutdown -h now )

But I can't find any related between the cron jobs of any users.

for user in $(cut -f1 -d: /etc/passwd); do echo -n "$user: "; sudo crontab -u $user -l | grep shutdown; echo; done

Any Idea, how can I find the source of the shutdown reported by syslog?

Mattia72
  • 101
  • 3

1 Answers1

1

If you can't find anything in the user's crontabs, it is very likely there's an entry in /etc/crontab that is kicking off the shutdown procedure.

stevieb
  • 1,466
  • 9
  • 11