Linux Shutdown Command and Logfile

In the enterprise Linux setup, it is necessary to keep the track of server shutdown and reboot time. Most of you may have used the shutdown / reboot command.

Show Listing of Last Reboot / Shutdown Date and Time

The last command searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created. The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

Shutdown (halt) System Immediately

Type the following command:
# shutdown -h 0
OR
# shutdown -h now

However, on all production boxes above command is dangerous. It won’t allow users to save files or data. It is a better idea to give all logged in users warning message. You can send message to all users as follows:
# shutdown +5 "*** Server is going DOWN for hard disk replacement!!! Please save all your work ***"

Schedules Shutdown Command

You can schedules shutdown with the shutdown command as follows:

shutdown -h 1:00 "SERVER DOWN"
shutdown -h 18:00 "SERVER (db4) is going DOWN due to UPS failure."

First one will shutdown server at 1:00 AM and second will be at 6:00 PM using 24 hrs clock format.

How Do I Find Out Server Shutdown / Reboot Time?

A entry is created in /var/log/wtmp file when you shutdown or reboot the server. You can read this log file with the help of last command.

Task: Display List of last Reboot Entires

Type the following command:
# last reboot | less
Sample outputs:

reboot   system boot  2.6.18-238.12.1. Sun Jun  5 07:56         (17+00:07)
reboot   system boot  2.6.18-238.9.1.e Sat Apr 30 05:08         (36+02:44)
reboot   system boot  2.6.18-238.9.1.e Fri Apr 22 02:38         (8+02:25)
reboot   system boot  2.6.18-238.5.1.e Sat Mar  5 19:13         (47+06:21)
reboot   system boot  2.6.18-238.1.1.e Sat Jan 22 06:44         (42+12:25)
reboot   system boot  2.6.18-238.el5   Sun Jan 16 13:29         (5+17:11)
reboot   system boot  2.6.18-194.32.1. Sat Jan  8 04:19         (8+09:05)
reboot   system boot  2.6.18-194.26.1. Wed Dec  8 11:52         (30+16:24)
reboot   system boot  2.6.18-194.26.1. Tue Nov 30 13:36         (38+14:40)
reboot   system boot  2.6.18-194.26.1. Mon Nov 22 15:58         (46+12:17)
reboot   system boot  2.6.18-194.26.1. Mon Nov 15 16:55         (53+11:21)
reboot   system boot  2.6.18-194.26.1. Mon Nov 15 16:52         (53+11:24)
reboot   system boot  2.6.18-194.26.1. Sun Nov 14 02:42         (1+14:03)
reboot   system boot  2.6.18-194.17.4. Wed Oct 27 01:03         (18+01:56)
reboot   system boot  2.6.18-194.17.1. Wed Oct 13 16:33         (13+08:26)
reboot   system boot  2.6.18-194.17.1. Thu Sep 30 00:55         (13+15:22)
reboot   system boot  2.6.18-194.11.4. Tue Sep 21 13:42         (8+10:52)
reboot   system boot  2.6.18-194.11.3. Wed Sep  1 09:16         (20+02:50)
reboot   system boot  2.6.18-194.11.1. Thu Aug 12 00:21         (20+08:40)
reboot   system boot  2.6.18-194.8.1.e Mon Jul 19 16:27         (23+07:50)
reboot   system boot  2.6.18-194.8.1.e Wed Jul 14 14:09         (5+02:09)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 20:24          (17:41)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 20:12          (00:08)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 12:17          (08:03)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 12:09          (00:04)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 10:42          (01:05)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 10:36          (00:02)
reboot   system boot  2.6.18-194.el5   Tue Jul 13 10:26          (00:05)

Task: Display List of Last Shutdown Entires

Type the following command:
# last -x| less
OR
# last -x | grep shutdown | less
Sample outputs:

shutdown system down  2.6.18-238.9.1.e Sun Jun  5 07:53 - 08:05 (17+00:12)
shutdown system down  2.6.18-238.9.1.e Sat Apr 30 05:05 - 07:52 (36+02:47)
shutdown system down  2.6.18-238.5.1.e Fri Apr 22 02:35 - 05:04 (8+02:29)
shutdown system down  2.6.18-238.1.1.e Sat Mar  5 19:10 - 02:35 (47+06:24)
shutdown system down  2.6.18-238.el5   Sat Jan 22 06:40 - 19:09 (42+12:29)
shutdown system down  2.6.18-194.32.1. Sun Jan 16 13:26 - 06:40 (5+17:14)
shutdown system down  2.6.18-194.26.1. Sat Jan  8 04:17 - 13:25 (8+09:08)
shutdown system down  2.6.18-194.26.1. Mon Nov 15 16:46 - 04:16 (53+11:30)
shutdown system down  2.6.18-194.17.1. Wed Oct 27 01:00 - 02:00 (18+02:00)
shutdown system down  2.6.18-194.8.1.e Thu Aug 12 00:18 - 09:02 (20+08:43)
shutdown system down  2.6.18-194.8.1.e Wed Jul 14 14:07 - 16:19 (5+02:12)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 20:21 - 14:06  (17:45)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 12:13 - 20:20  (08:07)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 11:48 - 12:13  (00:24)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 10:38 - 11:48  (01:09)
shutdown system down  2.6.18-194.el5   Tue Jul 13 10:32 - 10:38  (00:05)

The -x option shows the system shutdown entries and run level changes.

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

13 comment

Hanafi says:
April 24, 2008 at 3:11 am
Hi! I’m try to find out the answer on this question.
What is the file that control shutdown in Linux?
Hopefully you can give answer.
nixCraft says:
April 24, 2008 at 5:56 am
/etc/shutdown.allow, /fastboot, and /etc/inittab. Try man shutdown for info.
Na.Stalin says:
January 5, 2009 at 11:23 am
we maintaing the server using fedore core 3 but 3 times in a week we have to restart the server ultimately, what is the reason. most of times mysql error is displayed
Divakar says:
February 24, 2009 at 3:33 pm
Hi,
How do we confirm if its abrupt shutdown. Which logs files need to look?
Kindly help.
Thanks
Alejandro says:
March 15, 2009 at 1:30 pm
Abrupt shutdowns leave abrupt messages or no messages at all. see if you get a core or a kernel dump in the messages. What this post did not answer is the question. WHO rebooted the server?
Raul says:
December 4, 2009 at 5:42 pm
This post did not tell how can one identify if the system was warm booted or cold booted (someone physically power cycled it)…
satish says:
April 22, 2010 at 12:26 am
how to shoutdown linux server i forgt cammand camm…is that in…0
Johnn says:
June 2, 2010 at 8:19 am
dear,
sir, how to setting auto rebooting on linux?
can your give me details?
thanks..
Philippe Petrinko says:
June 21, 2011 at 2:42 pm
Hi Vivek,
Typos above: missing opening double-quote on 2 lines:
# shutdown 1:00 SERVER DOWN”
# shutdown 18:00 SERVER DOWN”
KUTGW,
– P
1. nixCraft says:
  June 22, 2011 at 1:17 pm
  The post has been updated with additional info.
Kelly says:
July 16, 2011 at 4:49 am
Great and simple solutions, loved your blog / site.
MIKI says:
May 22, 2014 at 1:40 pm
Hi,
Does someone knows what is the command for “warm” reboot [If such exist]?
1. Philippe Petrinko says:
  May 24, 2014 at 1:01 pm
  Hi Miki,
  You are talking about a “warm” reboot, but what is, according to you, a “cold” reboot? (or whatever you would call “other” reboots?
  What is your “temperature” typology for reboots? According to what source? (web site, web pages, books?)
  –P

Have a question? Post it on our forum!