Check Linux Shutdown Reboot Date: 5 Commands
- Days to look back
- 30 days
- You entered
To check when a Linux system was shut down or rebooted, use the last command with shutdown or reboot arguments, or inspect the journalctl boot logs. This article explains the exact commands and how to read their output.
Why You Need Shutdown and Reboot History
Knowing when a Linux machine last shut down or rebooted helps diagnose uptime issues, verify scheduled maintenance, and audit system activity. For servers, unexpected reboots can indicate crashes or power failures. For desktops, you might want to confirm a clean shutdown after a kernel update. The system records these events in several log files, and multiple commands can retrieve them.
The last Command: The Primary Tool
The last command reads the wtmp binary log file (typically /var/log/wtmp) and displays login and logout sessions, including system shutdowns and reboots. To see only shutdown and reboot records, use:
last -x shutdown reboot– shows both shutdown and reboot entries with timestamps.last -x shutdown– shows only shutdown entries.last -x reboot– shows only reboot entries.
The output includes the date and time, the user (often shutdown or reboot), and the system console. For example:
reboot system boot 5.15.0-91-generic Sat Mar 15 10:23 still running
The still running line indicates the last reboot is the current boot. If you want to see the exact shutdown timestamp, look for a line that says shutdown with a time, followed by a line that says down.
Using journalctl for Boot History (systemd)
On systems using systemd (most modern distributions), the journal logs every boot. To list all boots with their timestamps, run:
journalctl --list-boots
This shows a numeric ID, the first and last log timestamps for each boot. The first boot is the oldest, and the last is the current one. To see the shutdown and reboot events in detail, use:
journalctl -b -1 | grep -E "Shutdown|Reboot"
Replace -1 with the boot ID from the list to inspect a specific session. For the current boot, use -b 0 or just journalctl -b.
Checking Uptime and Last Reboot with uptime and who
If you only need the last reboot time, the uptime command shows how long the system has been running, but not the exact date. To get the precise boot time, use:
who -b
This prints the system boot date and time. For a more detailed view, uptime -s (on systemd systems) gives the same boot time in a parseable format. These commands are useful for quickly confirming when the last reboot occurred without digging into logs.
Reading the dmesg and syslog for Shutdown Messages
Older systems or those without systemd may log shutdown and reboot messages in /var/log/syslog or /var/log/messages. You can search for lines containing shutdown or reboot:
grep -i "shutdown\|reboot" /var/log/syslog | tail -20
This approach is less precise because log rotation may have removed old entries, but it can still reveal the last shutdown time. For real-time monitoring, you can use dmesg to see kernel messages, but it does not typically show shutdown timestamps after a reboot.
Common Pitfalls and Misconceptions
A frequent mistake is confusing the last output with login times. The reboot entry shows the time the system booted, not the time it shut down. To find the shutdown time, look for the shutdown entry that appears just before the down line. Another issue is that wtmp may be rotated, so very old shutdowns are not available. If you need to track shutdowns over a long period, consider enabling persistent journal storage with journalctl --flush and setting Storage=persistent in /etc/systemd/journald.conf.
Frequently Asked Questions
How do I find the last shutdown time?
Run last -x shutdown | head -1. The first line shows the most recent shutdown. If the system is currently running, it will show the last shutdown before the current boot.
What is the difference between shutdown and reboot entries?
A shutdown entry indicates the system was powered off, while a reboot entry indicates the system was restarted without a full power-off. Both are recorded in wtmp, but they represent different events.
Can I see shutdown history if wtmp is rotated?
No, once wtmp is rotated, old entries are lost. However, systemd journal logs may persist if configured. Use journalctl --list-boots to see how far back the journal goes.
Why does last reboot show multiple entries?
Each line represents a separate boot event. The most recent is at the top. If you see many reboots, it might indicate a crash loop or frequent manual restarts.
Is there a GUI tool to view shutdown history?
Most desktop environments have a system log viewer (e.g., GNOME Logs) that shows boot and shutdown events. However, the command line tools are more precise and work on headless servers.
Related
Formula used
in t | Days to look back | days | 30 | 1 out n | Shutdown events found | count | 0 | 0
Each line is one input (in, sel, list) or one result (out: label, unit, formula, decimals). How the calculators work
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.