Linux Shutdown Command and Logfile

Author: Vivek Gite Last updated: September 26, 2005 13 comments

In the enterprise Linux setup, it is necessary to keep the track of server shutdown and reboot time. Most of you may have used the shutdown / reboot command.

Show Listing of Last Reboot / Shutdown Date and Time

The last command searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created. The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

Shutdown (halt) System Immediately

Type the following command:
# shutdown -h 0
OR
# shutdown -h now

However, on all production boxes above command is dangerous. It won’t allow users to save files or data. It is a better idea to give all logged in users warning message. You can send message to all users as follows:
# shutdown +5 "*** Server is going DOWN for hard disk replacement!!! Please save all your work ***"

Schedules Shutdown Command

You can schedules shutdown with the shutdown command as follows:

shutdown -h 1:00 "SERVER DOWN"
shutdown -h 18:00 "SERVER (db4) is going DOWN due to UPS failure."

First one will shutdown server at 1:00 AM and second will be at 6:00 PM using 24 hrs clock format.

How Do I Find Out Server Shutdown / Reboot Time?

A entry is created in /var/log/wtmp file when you shutdown or reboot the server. You can read this log file with the help of last command.

Task: Display List of last Reboot Entires

Type the following command:
# last reboot | less
Sample outputs:

reboot   system boot  2.6.18-238.12.1. Sun Jun  5 07:56         (17+00:07)
reboot   system boot  2.6.18-238.9.1.e Sat Apr 30 05:08         (36+02:44)
reboot   system boot  2.6.18-238.9.1.e Fri Apr 22 02:38         (8+02:25)
reboot   system boot  2.6.18-238.5.1.e Sat Mar  5 19:13         (47+06:21)
reboot   system boot  2.6.18-238.1.1.e Sat Jan 22 06:44         (42+12:25)
reboot   system boot  2.6.18-238.el5   Sun Jan 16 13:29         (5+17:11)
reboot   system boot  2.6.18-194.32.1. Sat Jan  8 04:19         (8+09:05)
reboot   system boot  2.6.18-194.26.1. Wed Dec  8 11:52         (30+16:24)
reboot   system boot  2.6.18-194.26.1. Tue Nov 30 13:36         (38+14:40)
reboot   system boot  2.6.18-194.26.1. Mon Nov 22 15:58         (46+12:17)
reboot   system boot  2.6.18-194.26.1. Mon Nov 15 16:55         (53+11:21)
reboot   system boot  2.6.18-194.26.1. Mon Nov 15 16:52         (53+11:24)
reboot   system boot  2.6.18-194.26.1. Sun Nov 14 02:42         (1+14:03)
reboot   system boot  2.6.18-194.17.4. Wed Oct 27 01:03         (18+01:56)
reboot   system boot  2.6.18-194.17.1. Wed Oct 13 16:33         (13+08:26)
reboot   system boot  2.6.18-194.17.1. Thu Sep 30 00:55         (13+15:22)
reboot   system boot  2.6.18-194.11.4. Tue Sep 21 13:42         (8+10:52)
reboot   system boot  2.6.18-194.11.3. Wed Sep  1 09:16         (20+02:50)
reboot   system boot  2.6.18-194.11.1. Thu Aug 12 00:21         (20+08:40)
reboot   system boot  2.6.18-194.8.1.e Mon Jul 19 16:27         (23+07:50)
reboot   system boot  2.6.18-194.8.1.e Wed Jul 14 14:09         (5+02:09)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 20:24          (17:41)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 20:12          (00:08)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 12:17          (08:03)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 12:09          (00:04)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 10:42          (01:05)
reboot   system boot  2.6.18-194.8.1.e Tue Jul 13 10:36          (00:02)
reboot   system boot  2.6.18-194.el5   Tue Jul 13 10:26          (00:05)

Task: Display List of Last Shutdown Entires

Type the following command:
# last -x| less
OR
# last -x | grep shutdown | less
Sample outputs:

shutdown system down  2.6.18-238.9.1.e Sun Jun  5 07:53 - 08:05 (17+00:12)
shutdown system down  2.6.18-238.9.1.e Sat Apr 30 05:05 - 07:52 (36+02:47)
shutdown system down  2.6.18-238.5.1.e Fri Apr 22 02:35 - 05:04 (8+02:29)
shutdown system down  2.6.18-238.1.1.e Sat Mar  5 19:10 - 02:35 (47+06:24)
shutdown system down  2.6.18-238.el5   Sat Jan 22 06:40 - 19:09 (42+12:29)
shutdown system down  2.6.18-194.32.1. Sun Jan 16 13:26 - 06:40 (5+17:14)
shutdown system down  2.6.18-194.26.1. Sat Jan  8 04:17 - 13:25 (8+09:08)
shutdown system down  2.6.18-194.26.1. Mon Nov 15 16:46 - 04:16 (53+11:30)
shutdown system down  2.6.18-194.17.1. Wed Oct 27 01:00 - 02:00 (18+02:00)
shutdown system down  2.6.18-194.8.1.e Thu Aug 12 00:18 - 09:02 (20+08:43)
shutdown system down  2.6.18-194.8.1.e Wed Jul 14 14:07 - 16:19 (5+02:12)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 20:21 - 14:06  (17:45)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 12:13 - 20:20  (08:07)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 11:48 - 12:13  (00:24)
shutdown system down  2.6.18-194.8.1.e Tue Jul 13 10:38 - 11:48  (01:09)
shutdown system down  2.6.18-194.el5   Tue Jul 13 10:32 - 10:38  (00:05)

The -x option shows the system shutdown entries and run level changes.

Related previous topics:

🐧 Please support my work on Patreon or with a donation.
🐧 Get the latest tutorials on Linux, Open Source & DevOps via:

RSS feed or Weekly email newsletter
Share on Twitter • Facebook • 13 comments... add one ↓

Category	List of Unix and Linux commands
File Management	cat
Firewall	Alpine Awall • CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04
Network Utilities	dig • host • ip • nmap
OpenVPN	CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04
Package Manager	apk • apt
Processes Management	bg • chroot • cron • disown • fg • jobs • killall • kill • pidof • pstree • pwdx • time
Searching	grep • whereis • which
User Information	groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w
WireGuard VPN	Alpine • CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04

13 comments… add one

MIKI May 22, 2014 @ 13:40

Hi,
Does someone knows what is the command for “warm” reboot [If such exist]?

Reply Link
- Philippe Petrinko May 24, 2014 @ 13:01
  
  Hi Miki,
  
  You are talking about a “warm” reboot, but what is, according to you, a “cold” reboot? (or whatever you would call “other” reboots?
  
  What is your “temperature” typology for reboots? According to what source? (web site, web pages, books?)
  
  –P
  
  Reply Link
Kelly Jul 16, 2011 @ 4:49

Great and simple solutions, loved your blog / site.

Reply Link
Philippe Petrinko Jun 21, 2011 @ 14:42

Hi Vivek,

Typos above: missing opening double-quote on 2 lines:

# shutdown 1:00 SERVER DOWN”
# shutdown 18:00 SERVER DOWN”

KUTGW,

– P

Reply Link
- 🐧 nixCraft Jun 22, 2011 @ 13:17
  
  The post has been updated with additional info.
  
  Reply Link
Johnn Jun 2, 2010 @ 8:19

dear,
sir, how to setting auto rebooting on linux?
can your give me details?
thanks..

Reply Link
satish Apr 22, 2010 @ 0:26

how to shoutdown linux server i forgt cammand camm…is that in…0

Reply Link
Raul Dec 4, 2009 @ 17:42

This post did not tell how can one identify if the system was warm booted or cold booted (someone physically power cycled it)…

Reply Link
Alejandro Mar 15, 2009 @ 13:30

Abrupt shutdowns leave abrupt messages or no messages at all. see if you get a core or a kernel dump in the messages. What this post did not answer is the question. WHO rebooted the server?

Reply Link
Divakar Feb 24, 2009 @ 15:33

Hi,

How do we confirm if its abrupt shutdown. Which logs files need to look?

Kindly help.

Thanks

Reply Link
Na.Stalin Jan 5, 2009 @ 11:23

we maintaing the server using fedore core 3 but 3 times in a week we have to restart the server ultimately, what is the reason. most of times mysql error is displayed

Reply Link
🐧 nixCraft Apr 24, 2008 @ 5:56

/etc/shutdown.allow, /fastboot, and /etc/inittab. Try man shutdown for info.

Reply Link
Hanafi Apr 24, 2008 @ 3:11

Hi! I’m try to find out the answer on this question.

What is the file that control shutdown in Linux?

Hopefully you can give answer.

Reply Link