Logout scripts: not completed on shutdown, reboot

In Ubuntu, scripts for different runlevels are executed according to their presence in the /etc/rc[0-6].d directories. Runlevel 0 corresponds to shutdown, and 6 to reboot.

Typically the script is stored in /etc/init.d, and then symlinks are placed in the directories corresponding to the runlevels you require.

So in your case, write your script, store it in /etc/init.d/, then create a symlink in each of /etc/rc0.d and /etc/rc6.d (if you want both) pointing to your script.

Create a symlink like: /etc/rc0.d/K01myscipt -> /etc/init.d/myscript

The scripts in each runlevel directory will be executed in ASCIIbetical order, so if the order within the runlevel matters to you, choose the name of your symlink accordingly.

Hope that solves it. Don't forget to make it executable (sudo chmod +x myscript). Also, I'm not sure, but maybe you'll have to cancel shutdown at the beginning of the script - shutdown -c now and issue it again at the end - shutdown -h now.

Now to know, who issued the shutdown command :
1) Either, Well, you can do that with the help of wrapper script as follow:

a. mv /sbin/shutdown /sbin/shutdown-orig
b. vim /sbin/shutdown #!/bin/sh echo "$USER has initiated the shutdown process" >> /var/log/shutdown.owner /sbin/shutdown-orig "$@"
c. chmod 755 /sbin/shutdown

2) Or, a normal user only has access to the shutdown command via sudo and sudo commands are (typically) logged under /var/log/. So, you can check that. Hope it helps. For further information, kindly refer to my thread here. Don't forget to stop by and say Thanks to them.

EDIT: Concluding, If nothing works, Try using sudo and walling off access to shutdown/reboot and then only you can check for logs and know who initiated the shutdown process. Detail's in content below. Thanks. Wonderful Question, Learnt a Lot.

LightDM

Create a script in /etc/rc0.d.

sudo vim /etc/rc0.d/myScript
sudo chmod +x /etc/rc0.d/myScript

GDM

Add your command to the file /etc/gdm/PostSession/Default before the exit 0 line.

As before shutdown the user is logged off anyway, this should cover both bases.