How to check Shutdown and Restart History on Linux

As a system administrator, it’s your responsibility to keep the system up and running to avoid any service disruptions. However, sometimes there are situations when your system shuts down or reboots. This can be due to the system unexpectedly losing power or some user intentionally rebooting it. Whatever the reason, you can check your Linux system’s shutdown and restart history to see when this activity happened. This information will provide a starting point from which to begin troubleshooting.

Here are some methods to check the shutdown and restart history in Linux using the command line.

1. Using the last Command

The last command in Linux lists the history of all users who have logged in and out of the Linux system with the most recent entry at the top. It obtains this information from the wtmp file which maintains a log of every login and logout event. You can check the shutdown history in your Linux system using the last command as follows:

last -x -F shutdown

Each entry in the output shows two timestamps where the first timestamp is for system shutdown and the second is for system startup. It also shows the duration for which the system kept running.

You can also check the last specific number of shutdown events using the -n flag. For instance, to check the last three shutdown events, the command would be:

last -x -F -n 3 shutdown

To check the restart history in your Linux system, use the following command:

last -x -F reboot

Each entry in the output shows two timestamps where the first timestamp is for the system startup and the second is for the system shutdown.

To check the last specific number of restart events, use the -n flag with the last command. For instance, to check the last three restart events, the command would be:

last -x -F -n 3 reboot

2. Using the tuptime Command

The tuptime tool displays the history and statistics of all the shutdowns and restarts of a Linux system. You can install this tool on any Linux distribution using the following one-liner script:

bash < <(curl -Ls https://git.io/tuptime-install.sh)

Once installed, you can use the tuptime tool to check the shutdown and restart history in your Linux system as follows:

tuptime -t

This command lists the history of restarts and shutdowns with the most recent entry at the bottom.

To list only the last specific number of entries, you can pipe the output of the tuptime command to the tail command. For instance, to list the last three entries, the command would be:

tuptime -t | tail -3

3. Using the who Command

The who command in Linux shows information about the users who are logged in to your system. You can use the who command with the -b flag to display when your system last booted:

who -b

4. Using the journalctl Command

The journalctl command is used to query and view logs collected by systemd. You can check your shutdown and restart history using the journalctl command with the –list-boots flag:

journalctl --list-boots

It returns the list of system boots with the most recent entry at the bottom, numbered 0. The first timestamp in the output shows the system startup time whereas the second timestamp shows the system shutdown time.

5. Check System Uptime

Additionally, you can also use the uptime command to find the system uptime from last booted. Just open the terminal on your system type uptime and hit enter.

uptime  

Conclusion

While you can’t really identify the reason for your system shutdown or reboot using these methods, information on when your system was rebooted or shut down can help you troubleshoot the issues.

Good Luck!