Is there a log that records shutdowns in Linux?

How about command last -x shutdown?


The /var/log/messages file really should have something relating to shutdowns in it, for instance mine (CentOS 5) has lines like this:

Jul 18 23:00:13 nero shutdown[2649]: shutting down for system halt
...
Jul 18 23:00:27 nero kernel: Kernel logging (proc) stopped.
Jul 18 23:00:27 nero kernel: Kernel log daemon terminating.

Check your /etc/syslog.conf or /etc/rsyslog.conf or equivalent to make sure logs are going there. You'll probably need root privileges to read the log files.

Also, while it's not shutdowns per se, the "last" command should report reboots.

Is there really nothing at all in the logs around the time you last shut down?

For your testing, bear in mind that your computer only knows it has 10 minutes left because of the information the battery is reporting, which may or may not be accurate. Rather than waiting for shutdowns you could look at the ACPI information directly. On my laptop it's here:

/proc/acpi/battery/BAT0/

In there, the "state" and "info" files look interesting. You could watch the remaining capacity in the state file while you're running your laptop under various conditions to see how quickly it drops.


First, let me start by saying I know this is an older thread. I only comment so that others that find this while poking around the net (as I did today) will have a clear answer.

Second, please note that the following command is bad practice and falls under the "useless uses of cat" (google search for it) category...

cat /var/log/messages | grep "`LC_ALL=en_en.utf8 date +"%b %e"`"

That line should be changed to:

grep "`LC_ALL=en_en.utf8 date +"%b %e"`" /var/log/messages

grep, and most unix/linux commands (sed, awk, etc...) for that matter do not require cat to read a files contents. It is sufficient to place the file path and name after the command to pass it as an argument. Adding a pipe and another external command (cat) is just wasted time and resources.

Finally, As to where to find a record of system shutdowns and/or reboots, use the last command as that is exactly what it is meant for. It reads the /var/log/wtmp log file for all login/logout entries. Because shutdowns and reboots are actually a system level login/logout event, they are recorded here. The same applies for root console shutdown, it is a logout event.

Example:

last -5 reboot shutdown root

This will give you the last 5 reboot, shutdown, and root (console shutdown included) entries in the wtmp log.

Result:

reboot    ~                         Mon Mar 23 14:51
shutdown  ~                         Mon Mar 23 14:49
root      console                   Mon Mar 23 14:49 - shutdown  (00:00)
reboot    ~                         Mon Mar 16 09:54
shutdown  ~                         Thu Mar 12 17:41

I hope this helps anyone that stumbles across this thread. :-)

Tags:

Linux