I can find the entry in syslog:
Mar 29 22:15:01 raspi CRON: (root) CMD ( shutdown -h now )
But I can't find any related between the cron jobs of any users.
for user in $(cut -f1 -d: /etc/passwd); do echo -n "$user: "; sudo crontab -u $user -l | grep shutdown; echo; done
Any Idea, how can I find the source of the shutdown reported by syslog?