Hi,

we have a server (CentOS 6.4) running PostgreSQL, recently someone shut the db down and we want to find out who did this...

I see the db shutdown request in the postgresql log, and I suspect it was run as root (as a service) because we do not see any relevant shutdown commands in the postgres user's bash history file

Can someone point me in the right direction per figuring this out, who ran the command (I suspect it was root)? If so, where did the offending login come from (I.P.)? etc...

Thanks