≡ Menu

Linux Shutdown Command and Logfile

In the enterprise Linux setup, it is necessary to keep the track of server shutdown and reboot time. Most of you may have used the shutdown / reboot command.

Show Listing of Last Reboot / Shutdown Date and Time

The last command searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created. The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

Shutdown (halt) System Immediately

Type the following command:
# shutdown -h 0
OR
# shutdown -h now

However, on all production boxes above command is dangerous. It won't allow users to save files or data. It is a better idea to give all logged in users warning message. You can send message to all users as follows:
# shutdown +5 "*** Server is going DOWN for hard disk replacement!!! Please save all your work ***"

Schedules Shutdown Command

You can schedules shutdown with the shutdown command as follows:

 
shutdown -h 1:00 "SERVER DOWN"
shutdown -h 18:00 "SERVER (db4) is going DOWN due to UPS failure."
 

First one will shutdown server at 1:00 AM and second will be at 6:00 PM using 24 hrs clock format.

How Do I Find Out Server Shutdown / Reboot Time?

A entry is created in /var/log/wtmp file when you shutdown or reboot the server. You can read this log file with the help of last command.

Task: Display List of last Reboot Entires

Type the following command:
# last reboot | less
Sample outputs:

reboot   system boot  2.6.18-238.12.1. Sun Jun  5 07:56         (17+00:07)
reboot   system boot  2.6.18-238.9.1.e Sat Apr 30 05:08         (36+02:44)
reboot   system boot  2.6.18-238.9.1.e Fri Apr 22 02:38         (8+02:25)
reboot   system boot  2.6.18-238.5.1.e Sat Mar  5 19:13         (47+06:21)
reboot   system boot  2.6.18-238.1.1.e Sat Jan 22 06:44         (42+12:25)
reboot   system boot  2.6.18-238.el5   Sun Jan 16 13:29         (5+17:11)
reboot   system boot  2.6.18-194.32.1. Sat Jan  8 04:19         (8+09:05)
reboot   system boot  2.6.18-194.26.1. Wed Dec  8 11:52         (30+16:24)
reboot   system boot  2.6.18-194.26.1. Tue Nov 30 13:36         (38+14:40)
reboot   system boot  2.6.18-194.26.1. Mon Nov 22 15:58         (46+12:17)
reboot   system boot  2.6.18-194.26.1. Mon Nov 15 16:55         (53+11:21)
reboot   system boot  2.6.18-194.26.1. Mon Nov 15 16:52         (53+11:24)
reboot   system boot  2.6.18-194.26.1. Sun Nov 14 02:42         (1+14:03)
reboot   system boot  2.6.18-194.17.4. Wed Oct 27 01:03         (18+01:56)
reboot   system boot  2.6.18-194.17.1. Wed Oct 13 16:33         (13+08:26)
reboot   system boot  2.6.18-194.17.1. Thu Sep 30 00:55         (13+15:22)
reboot   system boot  2.6.18-194.11.4. Tue Sep 21 13:42         (8+10:52)
reboot   system boot  2.6.18-194.11.3. Wed Sep  1 09:16         (20+02:50)
reboot   system boot  2.6.18-194.11.1. Thu Aug 12 00:21         (20+08:40)
reboot   system boot  2.6.18-194.8.1.e Mon Jul 19 16:27         (23+07:50)
reboot   system boot  2.6.18-194.8.1.e Wed Jul 14 14:09         (5+02:09)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 20:24          (17:41)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 20:12          (00:08)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 12:17          (08:03)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 12:09          (00:04)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 10:42          (01:05)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 10:36          (00:02)
reboot   system boot  2.6.18-194.el5   Tue Jul 13 10:26          (00:05)

Task: Display List of Last Shutdown Entires

Type the following command:
# last -x| less
OR
# last -x | grep shutdown | less
Sample outputs:

shutdown system down  2.6.18-238.9.1.e Sun Jun  5 07:53 - 08:05 (17+00:12)
shutdown system down  2.6.18-238.9.1.e Sat Apr 30 05:05 - 07:52 (36+02:47)
shutdown system down  2.6.18-238.5.1.e Fri Apr 22 02:35 - 05:04 (8+02:29)
shutdown system down  2.6.18-238.1.1.e Sat Mar  5 19:10 - 02:35 (47+06:24)
shutdown system down  2.6.18-238.el5   Sat Jan 22 06:40 - 19:09 (42+12:29)
shutdown system down  2.6.18-194.32.1. Sun Jan 16 13:26 - 06:40 (5+17:14)
shutdown system down  2.6.18-194.26.1. Sat Jan  8 04:17 - 13:25 (8+09:08)
shutdown system down  2.6.18-194.26.1. Mon Nov 15 16:46 - 04:16 (53+11:30)
shutdown system down  2.6.18-194.17.1. Wed Oct 27 01:00 - 02:00 (18+02:00)
shutdown system down  2.6.18-194.8.1.e Thu Aug 12 00:18 - 09:02 (20+08:43)
shutdown system down  2.6.18-194.8.1.e Wed Jul 14 14:07 - 16:19 (5+02:12)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 20:21 - 14:06  (17:45)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 12:13 - 20:20  (08:07)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 11:48 - 12:13  (00:24)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 10:38 - 11:48  (01:09)
shutdown system down  2.6.18-194.el5   Tue Jul 13 10:32 - 10:38  (00:05)    

The -x option shows the system shutdown entries and run level changes.

Related previous topics:

Tweet itFacebook itGoogle+ itPDF itFound an error/typo on this page?

{ 13 comments… add one }

  • Hanafi April 24, 2008, 3:11 am

    Hi! I’m try to find out the answer on this question.

    What is the file that control shutdown in Linux?

    Hopefully you can give answer.

  • nixCraft April 24, 2008, 5:56 am

    /etc/shutdown.allow, /fastboot, and /etc/inittab. Try man shutdown for info.

  • Na.Stalin January 5, 2009, 11:23 am

    we maintaing the server using fedore core 3 but 3 times in a week we have to restart the server ultimately, what is the reason. most of times mysql error is displayed

  • Divakar February 24, 2009, 3:33 pm

    Hi,

    How do we confirm if its abrupt shutdown. Which logs files need to look?

    Kindly help.

    Thanks

  • Alejandro March 15, 2009, 1:30 pm

    Abrupt shutdowns leave abrupt messages or no messages at all. see if you get a core or a kernel dump in the messages. What this post did not answer is the question. WHO rebooted the server?

  • Raul December 4, 2009, 5:42 pm

    This post did not tell how can one identify if the system was warm booted or cold booted (someone physically power cycled it)…

  • satish April 22, 2010, 12:26 am

    how to shoutdown linux server i forgt cammand camm…is that in…0

  • Johnn June 2, 2010, 8:19 am

    dear,
    sir, how to setting auto rebooting on linux?
    can your give me details?
    thanks..

  • Philippe Petrinko June 21, 2011, 2:42 pm

    Hi Vivek,

    Typos above: missing opening double-quote on 2 lines:

    # shutdown 1:00 SERVER DOWN”
    # shutdown 18:00 SERVER DOWN”

    KUTGW,

    – P

    • nixCraft June 22, 2011, 1:17 pm

      The post has been updated with additional info.

  • Kelly July 16, 2011, 4:49 am

    Great and simple solutions, loved your blog / site.

  • MIKI May 22, 2014, 1:40 pm

    Hi,
    Does someone knows what is the command for “warm” reboot [If such exist]?

    • Philippe Petrinko May 24, 2014, 1:01 pm

      Hi Miki,

      You are talking about a “warm” reboot, but what is, according to you, a “cold” reboot? (or whatever you would call “other” reboots?

      What is your “temperature” typology for reboots? According to what source? (web site, web pages, books?)

      –P

Leave a Comment