Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering if there is a log file in Linux which records every time the computer is shut down?

The reason I am asking is I am doing some tests involving how long my laptop battery lasts under certain conditions. My laptop is configured to automatically shut down when there is about 10 minutes of battery power left, so if there is a log file somewhere that records when the computer is shut down, this will make my testing much easier.

I'm running Ubuntu 10.04. Thanks!

share|improve this question

migrated from Jul 24 '10 at 20:17

This question came from our site for professional and enthusiast programmers.

up vote 5 down vote accepted

The /var/log/messages file really should have something relating to shutdowns in it, for instance mine (CentOS 5) has lines like this:

Jul 18 23:00:13 nero shutdown[2649]: shutting down for system halt
Jul 18 23:00:27 nero kernel: Kernel logging (proc) stopped.
Jul 18 23:00:27 nero kernel: Kernel log daemon terminating.

Check your /etc/syslog.conf or /etc/rsyslog.conf or equivalent to make sure logs are going there. You'll probably need root privileges to read the log files.

Also, while it's not shutdowns per se, the "last" command should report reboots.

Is there really nothing at all in the logs around the time you last shut down?

For your testing, bear in mind that your computer only knows it has 10 minutes left because of the information the battery is reporting, which may or may not be accurate. Rather than waiting for shutdowns you could look at the ACPI information directly. On my laptop it's here:


In there, the "state" and "info" files look interesting. You could watch the remaining capacity in the state file while you're running your laptop under various conditions to see how quickly it drops.

share|improve this answer
Unless I'm missing it, I don't see any sort of "shutting down" message in /var/log/messages. The message "Kernel logging (proc) stopped" sometimes appears, but not always. However, running last -x works. This command displays a line that looks like the following: shutdown system down 2.6.32-23-generi Sun Jul 25 09:12 - 19:00 (-14815+-13: Thanks for the battery info tip. My system also has this, so I will have to check this out! It seems to update these files every 5 seconds or so. Thanks! – Michael Jul 25 '10 at 13:37
Thanks again. My results are here:… – Michael Jul 25 '10 at 15:39

How about command last -x shutdown?

share|improve this answer

The /var/log/messages file should contain this information

share|improve this answer
I didn't see anything in that file related to shutting down. :( I tried grepping all the other files in that directory using the timestamp of the time I shut down the computer, but no luck: grep -r "Jul 24 14:" /var/log/* – Michael Jul 24 '10 at 20:49
The file don't exists on linux mint mate 17. – Eric Wang Feb 4 '15 at 8:39

First, let me start by saying I know this is an older thread. I only comment so that others that find this while poking around the net (as I did today) will have a clear answer.

Second, please note that the following command is bad practice and falls under the "useless uses of cat" (google search for it) category...

cat /var/log/messages | grep "`LC_ALL=en_en.utf8 date +"%b %e"`"

That line should be changed to:

grep "`LC_ALL=en_en.utf8 date +"%b %e"`" /var/log/messages

grep, and most unix/linux commands (sed, awk, etc...) for that matter do not require cat to read a files contents. It is sufficient to place the file path and name after the command to pass it as an argument. Adding a pipe and another external command (cat) is just wasted time and resources.

Finally, As to where to find a record of system shutdowns and/or reboots, use the last command as that is exactly what it is meant for. It reads the /var/log/wtmp log file for all login/logout entries. Because shutdowns and reboots are actually a system level login/logout event, they are recorded here. The same applies for root console shutdown, it is a logout event.


last -5 reboot shutdown root

This will give you the last 5 reboot, shutdown, and root (console shutdown included) entries in the wtmp log.


reboot    ~                         Mon Mar 23 14:51
shutdown  ~                         Mon Mar 23 14:49
root      console                   Mon Mar 23 14:49 - shutdown  (00:00)
reboot    ~                         Mon Mar 16 09:54
shutdown  ~                         Thu Mar 12 17:41

I hope this helps anyone that stumbles across this thread. :-)

share|improve this answer
Alternatively simply last -x or last -F -R -x runlevel. For the purpose of battery monitoring under Ubuntu, grep hooks /var/log/pm-suspend.log may also be useful to show suspend and resumes. Unfortunately, pm-powersave.log does not store times AC power is connected (unless you add your own hook). may be worth a read. – Cedric Knight Jun 5 '15 at 6:36

if you want to keep track of how long your computer has been up in the past you can use something like uptimed.

it comes with a program called uprecords that show you how long your computer has been on.

share|improve this answer

if no log is present, you may try to add some 'date >>mylog' to shutdown script(in some dists, it is called rc.shutdown)

or,there is also a way without previlage needed. run:

while [ 1 ];do sleep 5;date>mylog;sync;done

and tail mylog on next session.

share|improve this answer

Here is a one-liner to list all messages from current day:

cat /var/log/messages | grep "`LC_ALL=en_en.utf8 date +"%b %e"`"

This was tested on CentOS so YMMV.

And of course there is last reboot and last shutdown (as mentioned), but this is too simple for my needs (only provides dates).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.