Home / server / Questions / 364984
In Process
Jack Z
Asked: 2012-03-01 10:13:57 +0800 CST

How can I tell if a system rebooted as well as the time of the reboot by looking at the system logs?

  • 772

How can I tell if a Linux system rebooted and determine the time of the reboot by looking at the system logs, such as /var/log/messages?

linux

5 Answers

  1. Very, very easy. The last command parses /var/log/wtmp for user activity including pseudo-user reboot.

    Use the command: last reboot

    See man last for more information. http://linux.die.net/man/1/last

    The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

    If the /var/log/wtmp file was rotated since your last reboot, you may be able to see prior reboots by using last -f /var/log/wtmp.1 reboot.

    • 28

  2. It varies from distribution to distribution. Sometimes /var/log/{messages,syslog,dmesg} will include it. For one I just rebooted, my last 2 lines and the very first ones after the reboot are:

    Feb 29 13:16:07 hostname kernel: Kernel logging (proc) stopped.
Feb 29 13:16:07 hostname rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="592" x-info="http://www.rsyslog.com"] exiting on signal 15.
Feb 29 13:23:15 hostname kernel: imklog 5.8.1, log source = /proc/kmsg started.
Feb 29 13:23:15 hostname rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="572" x-info="http://www.rsyslog.com"] start
Feb 29 13:23:15 hostname rsyslogd: rsyslogd's groupid changed to 103
Feb 29 13:23:15 hostname rsyslogd: rsyslogd's userid changed to 101
Feb 29 13:23:15 hostname rsyslogd-2039: Could no open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
Feb 29 13:23:15 hostname kernel: [    0.000000] Initializing cgroup subsys cpuset
Feb 29 13:23:15 hostname kernel: [    0.000000] Initializing cgroup subsys cpu
Feb 29 13:23:15 hostname kernel: [    0.000000] Linux version 3.0.0-12-server (buildd@crested) (gcc version 4.6.1 (Ubuntu/Linaro 4.6.1-9ubuntu3) ) #20-Ubuntu SMP Fri Oct 7 16:36:30 UTC 2011 (Ubuntu 3.0.0-12.20-server 3.0.4)
Feb 29 13:23:15 hostname kernel: [    0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.0.0-12-server root=/dev/mapper/hostname-root ro
Feb 29 13:23:15 hostname kernel: [    0.000000] KERNEL supported cpus:
Feb 29 13:23:15 hostname kernel: [    0.000000]   Intel GenuineIntel
Feb 29 13:23:15 hostname kernel: [    0.000000]   AMD AuthenticAMD
Feb 29 13:23:15 hostname kernel: [    0.000000]   Centaur CentaurHauls
Feb 29 13:23:15 hostname kernel: [    0.000000] Disabled fast string operations
Feb 29 13:23:15 hostname kernel: [    0.000000] BIOS-provided physical RAM map:

    ... and so-on. That shows a normal shutdown. An unexpected shutdown might not tell you the time it went offline, but you can guess based on the gap between the last message and the first depending on how noisy your system is.

    • 10

  3. Type the uptime command.

    This will tell you how long your system has been up, as well as load averages.

    Edit: you can also look for a /var/log/kern.log. This should contain kernel messages only, so it will be easier to find the boot messages.

    • 5

  4. Look in your /var/log/messages or /var/log/boot logs for the time of the system boot. An example from CentOS 6...

    Feb 28 23:05:56 dev0 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Feb 28 23:05:56 dev0 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1557" x-info="http://www.rsyslog.com"] (re)start
    • 2

  5. On Ubuntu, I look for the string \] Linux version in /var/log/syslog.

    It will match lines that look something like this:

    27 Jun 2017 12:33:42.268 Hostname:my-hostname : [ 0.000000] Linux version 3.13.0-100-generic (buildd@lgw01-52) (gcc version 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04.3) ) #147-Ubuntu SMP Tue Oct 18 16:48:51 UTC 2016 (Ubuntu 3.13.0-100.147-generic 3.13.11-ckt39) Context
    • 1