Shutdown entries randomly missing on both /var/log/wtmp and /var/log/audit/audit.log on RHEL 7 after reboot
Issue
- System shutdown not properly detected by: last -Fxn2 reboot shutdown
- Shutdown doesn't always record the audit SYSTEM_SHUTDOWN message
- auditd does not log all clean shutdowns/restarts
- last log not capturing shutdown event
Environment
- Red Hat Enterprise Linux Server 7
- systemd
- auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
