Whatever the reason is, you can check your Linux system’s shutdown and restart history to see when this activity exactly happened. This information will provide you with a starting point to begin the troubleshooting.
Check Linux System’s Shutdown and Restart History
Here are some methods to check the shutdown and restart history in Linux using the command line:
1. Using the last Command
The last command in Linux lists the history of all users who have logged in and out of the Linux system with the most recent entry at the top. It obtains this information from the wtmp file which maintains a log of every login and logout event. You can check the shutdown history in your Linux system using the last command as follows:
Each entry in the output shows two timestamps where the first timestamp is for system shutdown and the second is for system startup. It also shows the duration for which the system kept running.
You can also check the last specific number of shutdown events using the -n flag. For instance, to check the last three shutdown events, the command would be:
To check the restart history in your Linux system, use the following command:
Each entry in the output shows two timestamps where the first timestamp is for the system startup and the second is for the system shutdown.
To check the last specific number of restart events, use the -n flag with the last command. For instance, to check the last three restart events, the command would be:
2. Using the tuptime Command
The tuptime tool displays the history and statistics of all the shutdowns and restarts of a Linux system. You can install this tool on any Linux distribution using the following one-liner script:
Once installed, you can use the tuptime tool to check the shutdown and restart history in your Linux system as follows:
This command lists the history of restarts and shutdowns with the most recent entry at the bottom.
To list only the last specific number of entries, you can pipe the output of the tuptime command to the tail command. For instance, to list the last three entries, the command would be:
3. Using the who Command
The who command in Linux shows information about the users who are logged in to your system. You can use the who command with the -b flag to display when your system last booted:
4. Using the journalctl Command
The journalctl command is used to query and view logs collected by systemd. You can check your shutdown and restart history using the journalctl command with the –list-boots flag:
It returns the list of system boots with the most recent entry at the bottom, numbered 0. The first timestamp in the output shows the system startup time whereas the second timestamp shows the system shutdown time.
Troubleshooting Errors Is Much Easier on Linux
While you can’t really identify the reason for your system shutdown or reboot using these methods, information on when your system was rebooted or shut down can help you in troubleshooting the issues.
