Oracle question - reading the server log files

[szlamany]

I've got a client that had an Oracle "reporting region" shutdown on March 28th - and we want to know how it happened. The only people that have access to the box this service runs on are acting clueless.

This is the oracle log

Fri Mar 28 15:43:45 2014
Shutting down instance (immediate)
Stopping background process SMCO
Shutting down instance: further logons disabled
Stopping background process QMNC
Fri Mar 28 15:43:46 2014
Stopping background process CJQ0
Stopping background process MMNL
Stopping background process MMON
License high water mark = 8
All dispatchers and shared servers shutdown
alter database close normal
Fri Mar 28 15:43:49 2014
SMON: disabling tx recovery
SMON: disabling cache recovery
Fri Mar 28 15:43:49 2014
Shutting down archive processes
Archiving is disabled
Archive process shutdown avoided: 0 active
Thread 1 closed at log sequence 65054
Successful close of redo thread 1
Completed: alter database close normal
alter database dismount
Completed: alter database dismount
ARCH: Archival disabled due to shutdown: 1089
Shutting down archive processes
Archiving is disabled
Archive process shutdown avoided: 0 active
ARCH: Archival disabled due to shutdown: 1089
Shutting down archive processes
Archiving is disabled
Archive process shutdown avoided: 0 active
Fri Mar 28 15:43:51 2014
Stopping background process VKTM: 
Fri Mar 28 15:43:53 2014
Instance shutdown complete
Wed Apr 02 12:03:48 2014
Starting ORACLE instance (normal)
LICENSE_MAX_SESSION = 0
LICENSE_SESSIONS_WARNING = 0

And the attached images indicate SYSDBA as the culprit. Is there anything is what I've shown here that will allow us to pinpoint who did this? Any chance that some automatic process did this??

[abhijit]

Since the client user is "NT_AUTHORITY\SYSTEM", it looks like the database was shutdown by a job.

There is a very similar thread on the Oracle Forums.