Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can I tell if a Linux system rebooted and determine the time of the reboot by looking at the system logs, such as /var/log/messages?

share|improve this question
    
Rebooted how? Via a console command? Power loss? Hardware failure? –  devicenull Feb 29 '12 at 18:18
    
@devicenull : I think it should be all of the above, because it's useful to answer questions like "When did the power come back on again?" "The engineer did WHAT? When did this happen?" –  Stefan Lasiewski Feb 29 '12 at 18:46

4 Answers 4

Very, very easy. The last command parses /var/log/wtmp for user activity including pseudo-user reboot.

Use the command: last reboot

See man last for more information. http://linux.die.net/man/1/last

The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

If the /var/log/wtmp file was rotated since your last reboot, you may be able to see prior reboots by using last -f /var/log/wtmp.1 reboot.

share|improve this answer
    
Hi Aaron, thanks for your help! I tried "last reboot" on my system and got this: "wtmp begins Thu Mar 1 11:10:40 2012", however "uptime" gave me this: "17:29:21 up 6 days, 9:24, 7 users, load average: 0.00, 0.01, 0.05". The current time on my system is 17:31 Mar 1st, MST. So it seems like "last reboot" thought the system was rebooted less than a day ago, which isn't really true... Can you tell me more about how "last" determines the reboot time? Thanks! –  Jack Z Mar 2 '12 at 0:30
2  
That timestamp isn't indicating a reboot. You'd see a line that looks like reboot system boot [kernel] [date]. So this is telling you how far back wtmp goes and that there has been no reboots since the log began. Maybe the log rotated on Mar 1st? –  Aaron Copley Mar 2 '12 at 18:24
    
That must be it lol I tried on a few other systems and some of them do show lines like this: reboot system boot 2.6.27.19-5-defa Thu Jul 14 04:10 (64+12:37). Thanks a lot! –  Jack Z Mar 2 '12 at 18:59

It varies from distribution to distribution. Sometimes /var/log/{messages,syslog,dmesg} will include it. For one I just rebooted, my last 2 lines and the very first ones after the reboot are:

Feb 29 13:16:07 hostname kernel: Kernel logging (proc) stopped.
Feb 29 13:16:07 hostname rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="592" x-info="http://www.rsyslog.com"] exiting on signal 15.
Feb 29 13:23:15 hostname kernel: imklog 5.8.1, log source = /proc/kmsg started.
Feb 29 13:23:15 hostname rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="572" x-info="http://www.rsyslog.com"] start
Feb 29 13:23:15 hostname rsyslogd: rsyslogd's groupid changed to 103
Feb 29 13:23:15 hostname rsyslogd: rsyslogd's userid changed to 101
Feb 29 13:23:15 hostname rsyslogd-2039: Could no open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
Feb 29 13:23:15 hostname kernel: [    0.000000] Initializing cgroup subsys cpuset
Feb 29 13:23:15 hostname kernel: [    0.000000] Initializing cgroup subsys cpu
Feb 29 13:23:15 hostname kernel: [    0.000000] Linux version 3.0.0-12-server (buildd@crested) (gcc version 4.6.1 (Ubuntu/Linaro 4.6.1-9ubuntu3) ) #20-Ubuntu SMP Fri Oct 7 16:36:30 UTC 2011 (Ubuntu 3.0.0-12.20-server 3.0.4)
Feb 29 13:23:15 hostname kernel: [    0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.0.0-12-server root=/dev/mapper/hostname-root ro
Feb 29 13:23:15 hostname kernel: [    0.000000] KERNEL supported cpus:
Feb 29 13:23:15 hostname kernel: [    0.000000]   Intel GenuineIntel
Feb 29 13:23:15 hostname kernel: [    0.000000]   AMD AuthenticAMD
Feb 29 13:23:15 hostname kernel: [    0.000000]   Centaur CentaurHauls
Feb 29 13:23:15 hostname kernel: [    0.000000] Disabled fast string operations
Feb 29 13:23:15 hostname kernel: [    0.000000] BIOS-provided physical RAM map:

... and so-on. That shows a normal shutdown. An unexpected shutdown might not tell you the time it went offline, but you can guess based on the gap between the last message and the first depending on how noisy your system is.

share|improve this answer
    
Thanks for your help! So can I rely on the "kernel: [ 0.000000]" as an indicator for system reboot? –  Jack Z Mar 2 '12 at 0:44

Type the uptime command.

This will tell you how long your system has been up, as well as load averages.

Edit: you can also look for a /var/log/kern.log. This should contain kernel messages only, so it will be easier to find the boot messages.

share|improve this answer
    
Note: If this server is important, you should consider implementing a centralized syslog server with something like Nagios for monitoring system health and alert you of outages. I use and love AlienVault, which includes (components are optional): a syslog server, nagios, intrusion detection, vulnerability scanner, asset tracking and more. –  InChargeOfIT Feb 29 '12 at 20:25

Look in your /var/log/messages or /var/log/boot logs for the time of the system boot. An example from CentOS 6...

Feb 28 23:05:56 dev0 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Feb 28 23:05:56 dev0 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1557" x-info="http://www.rsyslog.com"] (re)start
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.