Determine system halt in c++

Alright so I'm working on a program written in c++ that is running as a daemon. It is primarily aiming Linux users, but I wish to include Windows (running as service) and Mac users as well.

I want the daemon to log whenever it is manually shut down. However it should not log shutdowns made by the system because of system halt or reboot.

Currently I've masked all signals and implemented some sort of handling using sigaction(). Before logging the shutdown, a function is also checking the system's runlevel, and if it is 0, 1 0r 6 the logging is omitted. The way to check the runlevel is to run the command "runlevel" and process the output.

My problem is that the runlevel is not always what I would expect it to. I'm running Ubuntu, and when logged in as usual I'm in runlevel 2, and that's the same when rebooting. When halting I sometimes get nothing as output from "runlevel". Different Linux distros are using their own runlevels, so it's not optimal for portability.

So is there a better way to determine if the system is halting? Also, is there a better way to catch interruptions, e.g. through exception handling etc?

I'll paste a snippet of the code, if it is of any help here. Written in c++, using the Poco C++ libraries.

void MainApplication::signalHandler(int sig) {
#if defined(POCO_OS_FAMILY_UNIX)
    switch(sig) {
        case -1:
            struct sigaction act;
            act.sa_handler = signalHandler;
            sigemptyset(&act.sa_mask);
            act.sa_flags = 0;
            sigaction(SIGINT, &act, 0); //Better way to do this?
            sigaction(SIGQUIT, &act, 0);
            sigaction(SIGKILL, &act, 0);
            sigaction(SIGTERM, &act, 0);
            sigaction(SIGHUP, &act, 0);
            sigaction(SIGSTOP, &act, 0);
            sigaction(SIGTSTP, &act, 0);
            sigaction(SIGCONT, &act, 0);
            sigaction(SIGUSR1, &act, 0);
            sigaction(SIGUSR2, &act, 0);
            break;
        case SIGINT:
        case SIGQUIT:
        case SIGTSTP:
        case SIGHUP:
        case SIGKILL:
        case SIGTERM:
            //Log Shutdown!
            if (!isHalting())
                _instance->_database->logBypass(BYPASS_SHUTDOWN);
            terminateNicely(true);
            break;
        case SIGCONT:
            //Continued, means stopped
            break;
        case SIGUSR1:
            //Resetting Net Responsibility
            _instance->uninitialize();
            _instance->initialize(*_instance);
            break;
        case SIGUSR2:
            //Other action or just mask it
            break;
        default:
            //Caught signal
            break;
    }
#endif
}



bool MainApplication::isHalting() {
#if defined(POCO_OS_FAMILY_UNIX)
    string cmd("runlevel");
    vector<string> args;
    Poco::Pipe outPipe;
    ProcessHandle ph = Process::launch(cmd, args, 0, &outPipe, 0);
    ph.wait();
    Poco::PipeInputStream istr(outPipe);
    stringstream ss;
    Poco::StreamCopier::copyStream(istr, ss);
    int runlevel;
    ss.seekg(-2, ios::end);
    ss >> runlevel;
    return (runlevel == 0 || runlevel == 1 || runlevel == 6);
#else
    return false;
#endif
}

I ended up going another route to solve the issue. Now I'm reading the computer's boot history and compares it to the history of the software to see if the computer booted or halted without the software. That's enough and will probably be even more accurate.

The command used to determine the boot history in Linux is

$ last reboot