[PATCH] reboot: log the task that requested a reboot or shutdown

[PATCH] reboot: log the task that requested a reboot or shutdown

[Bradley Morgan]

When a machine reboots or powers off, the kernel log records what
happened but not who asked for it.  The reboot syscall throws the
caller identity away, and reconstructing it afterwards from userspace
logs is unreliable and more likely than not impossible.
"What made this reboot?" is a question every fleet operator has had to
answer with guesswork.

log the comm and pid of the calling task once at the syscall boundary,
before the requested command is carried out, e.g:

  reboot: initiated by systemd-shutdow[1]
  reboot: Restarting system

The existing "Restarting system", "System halted" and "Power down"
lines are left untouched, so anything parsing dmesg today keeps
working. The two ctrl alt del toggle commands are excluded so init
setting the mode does not add a line to dmesg on every boot.

Signed-off-by: Bradley Morgan <include@grrlz.net>
---
 kernel/reboot.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/reboot.c b/kernel/reboot.c
index c10ac6a0200d..8ac96c527a4e 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -754,6 +754,10 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
 	if (ret)
 		return ret;
 
+	if (cmd != LINUX_REBOOT_CMD_CAD_ON && cmd != LINUX_REBOOT_CMD_CAD_OFF)
+		pr_info("initiated by %s[%d]\n",
+			current->comm, task_pid_nr(current));
+
 	/* Instead of trying to make the power_off code look like
 	 * halt when pm_power_off is not set do it the easy way.
 	 */
-- 
2.53.0

Re: [PATCH] reboot: log the task that requested a reboot or shutdown

[Bradley Morgan]

On July 19, 2026 4:29:09 PM GMT+01:00, Bradley Morgan <include@grrlz.net>
wrote:
>When a machine reboots or powers off, the kernel log records what
>happened but not who asked for it.  The reboot syscall throws the
>caller identity away, and reconstructing it afterwards from userspace
>logs is unreliable and more likely than not impossible.
>"What made this reboot?" is a question every fleet operator has had to
>answer with guesswork.
>
>log the comm and pid of the calling task once at the syscall boundary,
>before the requested command is carried out, e.g:
>
>  reboot: initiated by systemd-shutdow[1]
>  reboot: Restarting system
>
>The existing "Restarting system", "System halted" and "Power down"
>lines are left untouched, so anything parsing dmesg today keeps
>working. The two ctrl alt del toggle commands are excluded so init
>setting the mode does not add a line to dmesg on every boot.
>
>Signed-off-by: Bradley Morgan <include@grrlz.net>
>---
> kernel/reboot.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/kernel/reboot.c b/kernel/reboot.c
>index c10ac6a0200d..8ac96c527a4e 100644
>--- a/kernel/reboot.c
>+++ b/kernel/reboot.c
>@@ -754,6 +754,10 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
> 	if (ret)
> 		return ret;
> 
>+	if (cmd != LINUX_REBOOT_CMD_CAD_ON && cmd != LINUX_REBOOT_CMD_CAD_OFF)
>+		pr_info("initiated by %s[%d]\n",
>+			current->comm, task_pid_nr(current));
>+
> 	/* Instead of trying to make the power_off code look like
> 	 * halt when pm_power_off is not set do it the easy way.
> 	 */
>
Sashiko said something:
https://sashiko.dev/#/patchset/20260719152909.3133-1-include%40grrlz.net


Sashiko is correct, my bad.

Sending V2 that should fix it.
Thanks!