Linux Shutdown Command and Logfile

by nixcraft · 6 comments

In the enterprise Linux network, it is necessary to keep track of server shutdown and reboot time. Most of you may have used the shutdown / reboot command.

Show listing of last reboot / shutdown date and time

last command searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created. The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

Shutdown (halt) system immediately

Type the command as follows:
# shutdown -h 0

However on production server above command is dangerous as it won't allow users to save files/work/data. It is better to give users a warning and then take down the box:
# shutdown +5 "*** Server is going DOWN for hard disk replacement!!! Please save all your work ***"

Schedules shutdown command

You can also schedules shutdown with shutdown command
# shutdown 1:00 SERVER DOWN"
# shutdown 18:00 SERVER DOWN"

First one will shutdown server at 1:00 AM and second will be at 6:00 PM (it uses 24 hrs clock format)

How do I find out serve shutdown / reboot time?

Now most exciting part, how will you find out when system was last rebooted or halted (shutdown). Often new UNIX/Linux admin don't find out solution easily. When ever you issue shutdown/reboot command a entry created in /var/log/wtmp file, don't open or modify this binary data file. You can read this log file with the help of last command.

Display list of last reboot entires

Use last command as follows:
last reboot | less

Display list of last shutdown entires (includes run level changes):

Type the command as follows:
last -x| less

Or even better try:
# last -x | grep shutdown |less

Note file /var/log/wtmp is log file which stores previous login sessions and use last command to access information. Same commends works on FreeBSD and other UNIX like oses.

Related previous topics:

Featured Articles:

Want to read Linux tips and tricks, but don't have time to check our blog everyday? Subscribe to our daily email newsletter to make sure you don't miss a single tip/tricks. Subscribe to our weekly newsletter here!

{ 6 comments… read them below or add one }

1 Hanafi 04.24.08 at 3:11 am

Hi! I’m try to find out the answer on this question.

What is the file that control shutdown in Linux?

Hopefully you can give answer.

2 vivek 04.24.08 at 5:56 am

/etc/shutdown.allow, /fastboot, and /etc/inittab. Try man shutdown for info.

3 Na.Stalin 01.05.09 at 11:23 am

we maintaing the server using fedore core 3 but 3 times in a week we have to restart the server ultimately, what is the reason. most of times mysql error is displayed

4 Divakar 02.24.09 at 3:33 pm

Hi,

How do we confirm if its abrupt shutdown. Which logs files need to look?

Kindly help.

Thanks

5 Alejandro 03.15.09 at 1:30 pm

Abrupt shutdowns leave abrupt messages or no messages at all. see if you get a core or a kernel dump in the messages. What this post did not answer is the question. WHO rebooted the server?

6 Raul 12.04.09 at 5:42 pm

This post did not tell how can one identify if the system was warm booted or cold booted (someone physically power cycled it)…

Leave a Comment

You can use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Previous post:

Next post: