[ovirt-users] Re: VMs shutdown mysteriously

Here is what I found in the audit log: on Centos 7: type=SERVICE_START msg=audit(06/25/2020 15:24:18.967:80755) : pid=1 uid=root auid=unset ses=unset msg='unit=systemd-shutdownd comm=systemd exe=/usr/lib/systemd/systemd hostname=? addr=? terminal=? res=success' type=SYSTEM_RUNLEVEL msg=audit(06/25/2020 15:25:19.501:103256) : user pid=12951 uid=root auid=unset ses=unset msg='old-level=3 new-level=0 exe=/sbin/shutdown hostname=? addr=? terminal=? res=success' ---- type=SYSTEM_SHUTDOWN msg=audit(06/25/2020 15:25:19.501:103257) : user pid=12951 uid=root auid=unset ses=unset msg='init exe=/sbin/shutdown hostname=? addr=? terminal=? res=success' ============================================================= on Centos 6: [root@aries ~]# ausearch -i -p 12951 ---- type=USER_AUTH msg=audit(05/23/2020 20:23:44.890:8878) : user pid=12951 uid=ovirtagent auid=unset ses=unset msg='op=PAM:authentication acct=ovirtagent exe=/usr/sbin/userhelper hostname=? addr=? terminal=? res=success' ---- type=USER_ACCT msg=audit(05/23/2020 20:23:44.891:8879) : user pid=12951 uid=ovirtagent auid=unset ses=unset msg='op=PAM:accounting acct=ovirtagent exe=/usr/sbin/userhelper hostname=? addr=? terminal=? res=success' ---- type=SYSTEM_RUNLEVEL msg=audit(06/25/2020 15:25:19.501:103256) : user pid=12951 uid=root auid=unset ses=unset msg='old-level=3 new-level=0 exe=/sbin/shutdown hostname=? addr=? terminal=? res=success' ---- type=SYSTEM_SHUTDOWN msg=audit(06/25/2020 15:25:19.501:103257) : user pid=12951 uid=root auid=unset ses=unset msg='init exe=/sbin/shutdown hostname=? addr=? terminal=? res=success' ----