Examine los registros del sistema del arranque anterior con sudo journalctl -b -1 -e .
Examinar /var/log/auth.log .
¿Estás seguro de que no es uno de "interrupción/pico de energía", "sobrecalentamiento de la CPU", ....
En MI sistema (Ubuntu 16.04,6),
sudo journalctl | grep shutdown
Jan 29 12:58:07 bat sudo[14365]: walt : TTY=pts/0 ; PWD=/home/walt ; USER=root ; COMMAND=/sbin/shutdown now
Feb 12 11:23:59 bat systemd[1]: Stopped Ubuntu core (all-snaps) system shutdown helper setup service.
Feb 19 09:35:18 bat ureadahead[437]: ureadahead:lxqt-session_system-shutdown.png: Ignored relative path
Feb 19 09:35:18 bat ureadahead[437]: ureadahead:gshutdown_gshutdown.png: Ignored relative path
Feb 19 09:35:18 bat ureadahead[437]: ureadahead:mate-gnome-main-menu-applet_system-shutdown.png: Ignored relative path
Feb 27 16:45:40 bat systemd-shutdown[1]: Sending SIGTERM to remaining processes...
Mar 05 17:53:27 bat systemd-shutdown[1]: Sending SIGTERM to remaining processes...
Mar 15 09:57:45 bat systemd[1]: Stopped Ubuntu core (all-snaps) system shutdown helper setup service.
Mar 21 17:40:30 bat systemd[1]: Stopped Ubuntu core (all-snaps) system shutdown helper setup service.
Apr 15 18:16:37 bat systemd[1]: Stopped Ubuntu core (all-snaps) system shutdown helper setup service.
...
La primera línea muestra cuando el usuario walt hizo un sudo shutdown now .