How can I tell if a node shutdown or reboot was initiated by the administrator

If you start a shutdown from the admin console or SNMP, you will see a message like this:

192.168.14.84 <177>2016-06-30 19:06:04,540 ADMIN ANNOUNCE: Node shutdown requested by administrator

If you start a reboot from the admin console, you will see a message like this:

192.168.14.86 <177>2016-06-30 19:10:56,177 ADMIN ANNOUNCE: Node reboot requested by administrator