I can find the entry in syslog:

Mar 29 22:15:01 raspi CRON[14533]: (root) CMD (   shutdown -h now )

But I can't find any related between the cron jobs of any users.

for user in $(cut -f1 -d: /etc/passwd); do echo -n "$user: "; sudo crontab -u $user -l | grep shutdown; echo; done

Any Idea, how can I find the source of the shutdown reported by syslog?

  • Is there anything in /etc/crontab? – stevieb Mar 30 '17 at 13:03
  • Oh yes, there is! I searched through the whole /etc/cron.d and didn't noticed crontab itself. Thank you! – Mattia72 Mar 30 '17 at 13:09
  • Made it an answer :) – stevieb Mar 30 '17 at 14:06

If you can't find anything in the user's crontabs, it is very likely there's an entry in /etc/crontab that is kicking off the shutdown procedure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.