How to Check Shutdown and Restart History on Linux

As a system administrator, you are responsible for keeping the system running to avoid service interruptions. However, sometimes there are situations when your system shuts down or restarts. This can be due to the system losing power unexpectedly or a user restarting it intentionally.

Whatever the reason, you can review your Linux system’s shutdown and restart history to see exactly when this activity took place. This information gives you a starting point to begin troubleshooting.

Check the Linux system shutdown and restart history

Here are some methods to check shutdown and reboot history in Linux from command line:

1. Using the last command

The last command in Linux lists the history of all users who have logged in and out of the Linux system, with the most recent entry at the top. It receives this information from the wtmp File that keeps a log of all login and logout events. You can check the shutdown history in your Linux system with the last command like this:

last -x -F shutdown

Each entry in the output shows two timestamps, the first timestamp is for system shutdown and the second is for system startup. It also shows the duration for which the system was running.

You can also check the last specific number of shutdown events with -n Flag. For example, to check the last three shutdown events, the command is:

last -x -F -n 3 shutdown

Use the following command to check the reboot history in your Linux system:

last -x -F reboot

Each entry in the output shows two timestamps, the first timestamp is for the system startup and the second is for the system shutdown.

To check the last specific number of restart events, use the -n Flag with the last command. For example, to check the last three reboot events, the command is:

last -x -F -n 3 reboot

2. Using the tuptime command

The tuptime tool shows the history and statistics of all shutdowns and restarts of a Linux system. You can install this tool on any Linux distribution using the following one-line script:

sudo bash << (curl -Ls https://git.io/tuptime-install.sh)

Once installed, you can use the tuptime tool to check the shutdown and reboot history in your Linux system as follows:

tuptime -t

This command lists the history of reboots and shutdowns with the most recent entry below.

To list only the last specified number of entries, you can pipe the output of the tuptime command to the tail command. For example, to list the last three entries, the command is:

tuptime -t | tail -3

3. Using the who command

The who command in Linux displays information about the users logged into your system. You can use the who command with the -b Flag to display if your system was last booted:

who -b

4. Using the journalctl command

The journalctl command is used to query and display logs collected by systemd. You can view your shutdown and restart history using the journalctl command with the –list-boots Flag:

journalctl --list-boots 

It returns the boot list with the newest entry at the bottom and the number 0. The first timestamp in the output shows the system startup time, while the second timestamp shows the system shutdown time.

Troubleshooting is much easier on Linux

While these methods don’t really help you identify the reason your system shut down or restarted, information about when your system restarted or shut down can help you troubleshoot the issues.