16

How can I tell if a Linux system rebooted and determine the time of the reboot by looking at the system logs, such as /var/log/messages?

Improve this question
2
  • Rebooted how? Via a console command? Power loss? Hardware failure?
    – devicenull
    Feb 29, 2012 at 18:18
  • @devicenull : I think it should be all of the above, because it's useful to answer questions like "When did the power come back on again?" "The engineer did WHAT? When did this happen?"
    – Stefan Lasiewski
    Feb 29, 2012 at 18:46

5 Answers 5

Reset to default
28

Very, very easy. The last command parses /var/log/wtmp for user activity including pseudo-user reboot.

Use the command: last reboot

See man last for more information. http://linux.die.net/man/1/last

The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

If the /var/log/wtmp file was rotated since your last reboot, you may be able to see prior reboots by using last -f /var/log/wtmp.1 reboot.

Improve this answer
3
  • Hi Aaron, thanks for your help! I tried "last reboot" on my system and got this: "wtmp begins Thu Mar 1 11:10:40 2012", however "uptime" gave me this: "17:29:21 up 6 days, 9:24, 7 users, load average: 0.00, 0.01, 0.05". The current time on my system is 17:31 Mar 1st, MST. So it seems like "last reboot" thought the system was rebooted less than a day ago, which isn't really true... Can you tell me more about how "last" determines the reboot time? Thanks!
    – Jack Z
    Mar 2, 2012 at 0:30
  • 2
    That timestamp isn't indicating a reboot. You'd see a line that looks like reboot system boot [kernel] [date]. So this is telling you how far back wtmp goes and that there has been no reboots since the log began. Maybe the log rotated on Mar 1st?
    – Aaron Copley
    Mar 2, 2012 at 18:24
  • That must be it lol I tried on a few other systems and some of them do show lines like this: reboot system boot 2.6.27.19-5-defa Thu Jul 14 04:10 (64+12:37). Thanks a lot!
    – Jack Z
    Mar 2, 2012 at 18:59
10

It varies from distribution to distribution. Sometimes /var/log/{messages,syslog,dmesg} will include it. For one I just rebooted, my last 2 lines and the very first ones after the reboot are:

Feb 29 13:16:07 hostname kernel: Kernel logging (proc) stopped.
Feb 29 13:16:07 hostname rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="592" x-info="http://www.rsyslog.com"] exiting on signal 15.
Feb 29 13:23:15 hostname kernel: imklog 5.8.1, log source = /proc/kmsg started.
Feb 29 13:23:15 hostname rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="572" x-info="http://www.rsyslog.com"] start
Feb 29 13:23:15 hostname rsyslogd: rsyslogd's groupid changed to 103
Feb 29 13:23:15 hostname rsyslogd: rsyslogd's userid changed to 101
Feb 29 13:23:15 hostname rsyslogd-2039: Could no open output pipe '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
Feb 29 13:23:15 hostname kernel: [    0.000000] Initializing cgroup subsys cpuset
Feb 29 13:23:15 hostname kernel: [    0.000000] Initializing cgroup subsys cpu
Feb 29 13:23:15 hostname kernel: [    0.000000] Linux version 3.0.0-12-server (buildd@crested) (gcc version 4.6.1 (Ubuntu/Linaro 4.6.1-9ubuntu3) ) #20-Ubuntu SMP Fri Oct 7 16:36:30 UTC 2011 (Ubuntu 3.0.0-12.20-server 3.0.4)
Feb 29 13:23:15 hostname kernel: [    0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.0.0-12-server root=/dev/mapper/hostname-root ro
Feb 29 13:23:15 hostname kernel: [    0.000000] KERNEL supported cpus:
Feb 29 13:23:15 hostname kernel: [    0.000000]   Intel GenuineIntel
Feb 29 13:23:15 hostname kernel: [    0.000000]   AMD AuthenticAMD
Feb 29 13:23:15 hostname kernel: [    0.000000]   Centaur CentaurHauls
Feb 29 13:23:15 hostname kernel: [    0.000000] Disabled fast string operations
Feb 29 13:23:15 hostname kernel: [    0.000000] BIOS-provided physical RAM map:

... and so-on. That shows a normal shutdown. An unexpected shutdown might not tell you the time it went offline, but you can guess based on the gap between the last message and the first depending on how noisy your system is.

Improve this answer
1
  • Thanks for your help! So can I rely on the "kernel: [ 0.000000]" as an indicator for system reboot?
    – Jack Z
    Mar 2, 2012 at 0:44
5

Type the uptime command.

This will tell you how long your system has been up, as well as load averages.

Edit: you can also look for a /var/log/kern.log. This should contain kernel messages only, so it will be easier to find the boot messages.

Improve this answer
1
  • Note: If this server is important, you should consider implementing a centralized syslog server with something like Nagios for monitoring system health and alert you of outages. I use and love AlienVault, which includes (components are optional): a syslog server, nagios, intrusion detection, vulnerability scanner, asset tracking and more.
    – InChargeOfIT
    Feb 29, 2012 at 20:25
2

Look in your /var/log/messages or /var/log/boot logs for the time of the system boot. An example from CentOS 6...

Feb 28 23:05:56 dev0 kernel: imklog 4.6.2, log source = /proc/kmsg started.
Feb 28 23:05:56 dev0 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="1557" x-info="http://www.rsyslog.com"] (re)start
Improve this answer
1

On Ubuntu, I look for the string \] Linux version in /var/log/syslog.

It will match lines that look something like this:

27 Jun 2017 12:33:42.268 Hostname:my-hostname : [ 0.000000] Linux version 3.13.0-100-generic (buildd@lgw01-52) (gcc version 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04.3) ) #147-Ubuntu SMP Tue Oct 18 16:48:51 UTC 2016 (Ubuntu 3.13.0-100.147-generic 3.13.11-ckt39) Context
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.