logs – Identify which user or process initiated normal shutdown?


I’d like to identify why (who, what) showdown my MacBook Pro while it was left unattended. Some unsaved work was lost. It is fairly likely that a careless admin script was run through some automated means by my company. No one initiated shutdown through the GUI or keyboard. I’d like to discover more so that I can start a conversation with IT. (I have admin privaleges on my own laptop, and so does employer.) MacOS 10.14.6

$ log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h
Filtering the log data using "composedMessage CONTAINS "Previous shutdown cause""

Timestamp        Thread   Type     Activity    PID  TTL  
2020-10-15 19:11 0xcf     Default  0x0         0    0    kernel: (AppleSMC) Previous shutdown cause: 5
------------------------------------------------------------------------------------------------------

Code 5 means:

Correct Shut Down. Shutdown was initiated normally, from the macOS Shut Down menu or other shutdown command such as /sbin/shutdown. This does not indicate an issue with your system.

$ last
myusername  ttys003                   Fri Oct 16 06:38   still logged in
myusername  ttys002                   Thu Oct 15 19:14   still logged in
myusername  ttys001                   Thu Oct 15 19:14   still logged in
myusername  ttys000                   Thu Oct 15 19:14   still logged in
myusername  console                   Thu Oct 15 19:13   still logged in
reboot    ~                         Thu Oct 15 19:11 
myusername  ttys002                   Wed Oct 14 09:44 - crash (1+09:27)
The pseudo-user reboot logs in at reboots of the system, thus ``last
reboot'' will give an indication of mean time between reboot.