Linux Shutdown Command and Logfile

by on September 26, 2005 · 11 comments· LAST UPDATED June 22, 2011

in , ,

In the enterprise Linux setup, it is necessary to keep the track of server shutdown and reboot time. Most of you may have used the shutdown / reboot command.

Show Listing of Last Reboot / Shutdown Date and Time

The last command searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created. The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

Shutdown (halt) System Immediately

Type the following command:
# shutdown -h 0
OR
# shutdown -h now

However, on all production boxes above command is dangerous. It won't allow users to save files or data. It is a better idea to give all logged in users warning message. You can send message to all users as follows:
# shutdown +5 "*** Server is going DOWN for hard disk replacement!!! Please save all your work ***"

Schedules Shutdown Command

You can schedules shutdown with the shutdown command as follows:

 
shutdown -h 1:00 "SERVER DOWN"
shutdown -h 18:00 "SERVER (db4) is going DOWN due to UPS failure."
 

First one will shutdown server at 1:00 AM and second will be at 6:00 PM using 24 hrs clock format.

How Do I Find Out Server Shutdown / Reboot Time?

A entry is created in /var/log/wtmp file when you shutdown or reboot the server. You can read this log file with the help of last command.

Task: Display List of last Reboot Entires

Type the following command:
# last reboot | less
Sample outputs:

reboot   system boot  2.6.18-238.12.1. Sun Jun  5 07:56         (17+00:07)
reboot   system boot  2.6.18-238.9.1.e Sat Apr 30 05:08         (36+02:44)
reboot   system boot  2.6.18-238.9.1.e Fri Apr 22 02:38         (8+02:25)
reboot   system boot  2.6.18-238.5.1.e Sat Mar  5 19:13         (47+06:21)
reboot   system boot  2.6.18-238.1.1.e Sat Jan 22 06:44         (42+12:25)
reboot   system boot  2.6.18-238.el5   Sun Jan 16 13:29         (5+17:11)
reboot   system boot  2.6.18-194.32.1. Sat Jan  8 04:19         (8+09:05)
reboot   system boot  2.6.18-194.26.1. Wed Dec  8 11:52         (30+16:24)
reboot   system boot  2.6.18-194.26.1. Tue Nov 30 13:36         (38+14:40)
reboot   system boot  2.6.18-194.26.1. Mon Nov 22 15:58         (46+12:17)
reboot   system boot  2.6.18-194.26.1. Mon Nov 15 16:55         (53+11:21)
reboot   system boot  2.6.18-194.26.1. Mon Nov 15 16:52         (53+11:24)
reboot   system boot  2.6.18-194.26.1. Sun Nov 14 02:42         (1+14:03)
reboot   system boot  2.6.18-194.17.4. Wed Oct 27 01:03         (18+01:56)
reboot   system boot  2.6.18-194.17.1. Wed Oct 13 16:33         (13+08:26)
reboot   system boot  2.6.18-194.17.1. Thu Sep 30 00:55         (13+15:22)
reboot   system boot  2.6.18-194.11.4. Tue Sep 21 13:42         (8+10:52)
reboot   system boot  2.6.18-194.11.3. Wed Sep  1 09:16         (20+02:50)
reboot   system boot  2.6.18-194.11.1. Thu Aug 12 00:21         (20+08:40)
reboot   system boot  2.6.18-194.8.1.e Mon Jul 19 16:27         (23+07:50)
reboot   system boot  2.6.18-194.8.1.e Wed Jul 14 14:09         (5+02:09)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 20:24          (17:41)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 20:12          (00:08)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 12:17          (08:03)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 12:09          (00:04)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 10:42          (01:05)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 10:36          (00:02)
reboot   system boot  2.6.18-194.el5   Tue Jul 13 10:26          (00:05)

Task: Display List of Last Shutdown Entires

Type the following command:
# last -x| less
OR
# last -x | grep shutdown | less
Sample outputs:

shutdown system down  2.6.18-238.9.1.e Sun Jun  5 07:53 - 08:05 (17+00:12)
shutdown system down  2.6.18-238.9.1.e Sat Apr 30 05:05 - 07:52 (36+02:47)
shutdown system down  2.6.18-238.5.1.e Fri Apr 22 02:35 - 05:04 (8+02:29)
shutdown system down  2.6.18-238.1.1.e Sat Mar  5 19:10 - 02:35 (47+06:24)
shutdown system down  2.6.18-238.el5   Sat Jan 22 06:40 - 19:09 (42+12:29)
shutdown system down  2.6.18-194.32.1. Sun Jan 16 13:26 - 06:40 (5+17:14)
shutdown system down  2.6.18-194.26.1. Sat Jan  8 04:17 - 13:25 (8+09:08)
shutdown system down  2.6.18-194.26.1. Mon Nov 15 16:46 - 04:16 (53+11:30)
shutdown system down  2.6.18-194.17.1. Wed Oct 27 01:00 - 02:00 (18+02:00)
shutdown system down  2.6.18-194.8.1.e Thu Aug 12 00:18 - 09:02 (20+08:43)
shutdown system down  2.6.18-194.8.1.e Wed Jul 14 14:07 - 16:19 (5+02:12)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 20:21 - 14:06  (17:45)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 12:13 - 20:20  (08:07)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 11:48 - 12:13  (00:24)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 10:38 - 11:48  (01:09)
shutdown system down  2.6.18-194.el5   Tue Jul 13 10:32 - 10:38  (00:05)    

The -x option shows the system shutdown entries and run level changes.

Related previous topics:

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 11 comments… read them below or add one }

1 Hanafi April 24, 2008 at 3:11 am

Hi! I’m try to find out the answer on this question.

What is the file that control shutdown in Linux?

Hopefully you can give answer.

Reply

2 nixCraft April 24, 2008 at 5:56 am

/etc/shutdown.allow, /fastboot, and /etc/inittab. Try man shutdown for info.

Reply

3 Na.Stalin January 5, 2009 at 11:23 am

we maintaing the server using fedore core 3 but 3 times in a week we have to restart the server ultimately, what is the reason. most of times mysql error is displayed

Reply

4 Divakar February 24, 2009 at 3:33 pm

Hi,

How do we confirm if its abrupt shutdown. Which logs files need to look?

Kindly help.

Thanks

Reply

5 Alejandro March 15, 2009 at 1:30 pm

Abrupt shutdowns leave abrupt messages or no messages at all. see if you get a core or a kernel dump in the messages. What this post did not answer is the question. WHO rebooted the server?

Reply

6 Raul December 4, 2009 at 5:42 pm

This post did not tell how can one identify if the system was warm booted or cold booted (someone physically power cycled it)…

Reply

7 satish April 22, 2010 at 12:26 am

how to shoutdown linux server i forgt cammand camm…is that in…0

Reply

8 Johnn June 2, 2010 at 8:19 am

dear,
sir, how to setting auto rebooting on linux?
can your give me details?
thanks..

Reply

9 Philippe Petrinko June 21, 2011 at 2:42 pm

Hi Vivek,

Typos above: missing opening double-quote on 2 lines:

# shutdown 1:00 SERVER DOWN”
# shutdown 18:00 SERVER DOWN”

KUTGW,

- P

Reply

10 nixCraft June 22, 2011 at 1:17 pm

The post has been updated with additional info.

Reply

11 Kelly July 16, 2011 at 4:49 am

Great and simple solutions, loved your blog / site.

Reply

Leave a Comment

Tagged as: , , , , , , , , , , , ,

Previous post:

Next post: