There are win and lin hosts. Triggers are configured, and there is a desire to receive in the notification not only the fact of the restart, but also the username of the user who initiated the restart. with windows, it seems clear that you are interested in information about linux systems. It is clear that you need to look in auth. log/audit. log and secure.log, but does the log entry differ when using the restart, systemctl restart, shutdown-r commands? And when does zabbix get the information, before or after the reboot?
Sorry for bad english.
Sorry for bad english.