I was wondering if there is a log file in Linux which records every time the computer is shut down?

The reason I am asking is I am doing some tests involving how long my laptop battery lasts under certain conditions. My laptop is configured to automatically shut down when there is about 10 minutes of battery power left, so if there is a log file somewhere that records when the computer is shut down, this will make my testing much easier.

I'm running Ubuntu 10.04. Thanks!


11 Answers 11


The /var/log/messages file really should have something relating to shutdowns in it, for instance mine (CentOS 5) has lines like this:

Jul 18 23:00:13 nero shutdown[2649]: shutting down for system halt
Jul 18 23:00:27 nero kernel: Kernel logging (proc) stopped.
Jul 18 23:00:27 nero kernel: Kernel log daemon terminating.

Check your /etc/syslog.conf or /etc/rsyslog.conf or equivalent to make sure logs are going there. You'll probably need root privileges to read the log files.

Also, while it's not shutdowns per se, the "last" command should report reboots.

Is there really nothing at all in the logs around the time you last shut down?

For your testing, bear in mind that your computer only knows it has 10 minutes left because of the information the battery is reporting, which may or may not be accurate. Rather than waiting for shutdowns you could look at the ACPI information directly. On my laptop it's here:


In there, the "state" and "info" files look interesting. You could watch the remaining capacity in the state file while you're running your laptop under various conditions to see how quickly it drops.

  • 4
    Unless I'm missing it, I don't see any sort of "shutting down" message in /var/log/messages. The message "Kernel logging (proc) stopped" sometimes appears, but not always. However, running last -x works. This command displays a line that looks like the following: shutdown system down 2.6.32-23-generi Sun Jul 25 09:12 - 19:00 (-14815+-13: Thanks for the battery info tip. My system also has this, so I will have to check this out! It seems to update these files every 5 seconds or so. Thanks!
    – Michael
    Jul 25, 2010 at 13:37
  • Thanks again. My results are here: mangstacular.blogspot.com/2010/07/…
    – Michael
    Jul 25, 2010 at 15:39

How about command last -x shutdown?


First, let me start by saying I know this is an older thread. I only comment so that others that find this while poking around the net (as I did today) will have a clear answer.

Second, please note that the following command is bad practice and falls under the "useless uses of cat" (google search for it) category...

cat /var/log/messages | grep "`LC_ALL=en_en.utf8 date +"%b %e"`"

That line should be changed to:

grep "`LC_ALL=en_en.utf8 date +"%b %e"`" /var/log/messages

grep, and most unix/linux commands (sed, awk, etc...) for that matter do not require cat to read a files contents. It is sufficient to place the file path and name after the command to pass it as an argument. Adding a pipe and another external command (cat) is just wasted time and resources.

Finally, As to where to find a record of system shutdowns and/or reboots, use the last command as that is exactly what it is meant for. It reads the /var/log/wtmp log file for all login/logout entries. Because shutdowns and reboots are actually a system level login/logout event, they are recorded here. The same applies for root console shutdown, it is a logout event.


last -5 reboot shutdown root

This will give you the last 5 reboot, shutdown, and root (console shutdown included) entries in the wtmp log.


reboot    ~                         Mon Mar 23 14:51
shutdown  ~                         Mon Mar 23 14:49
root      console                   Mon Mar 23 14:49 - shutdown  (00:00)
reboot    ~                         Mon Mar 16 09:54
shutdown  ~                         Thu Mar 12 17:41

I hope this helps anyone that stumbles across this thread. :-)

  • Alternatively simply last -x or last -F -R -x runlevel. For the purpose of battery monitoring under Ubuntu, grep hooks /var/log/pm-suspend.log may also be useful to show suspend and resumes. Unfortunately, pm-powersave.log does not store times AC power is connected (unless you add your own hook). help.ubuntu.com/community/PowerManagement/ReducedPower may be worth a read. Jun 5, 2015 at 6:36
  • Regarding UUoC, $CPU time << $Brain time...
    – MikeP
    Aug 2, 2016 at 21:27
  • 3
    Each person mentioning "useless uses of cat" is probably spending more time to point the fact than the total CPU time spend on useless uses of cat by all computers on earth (and sometimes they needlessly bloat their otherwise nice answer as a side-effect -- like this one)
    – ndemou
    Nov 1, 2016 at 13:55

The /var/log/messages file should contain this information

  • I didn't see anything in that file related to shutting down. :( I tried grepping all the other files in that directory using the timestamp of the time I shut down the computer, but no luck: grep -r "Jul 24 14:" /var/log/*
    – Michael
    Jul 24, 2010 at 20:49
  • The file don't exists on linux mint mate 17.
    – Eric
    Feb 4, 2015 at 8:39

The most simple way not only to see the shutdowns but also to see booting time:

journalctl --list-boots > file.txt

It shows the time when the last boot occurred and the moment your system was shut down since the first day ever.


last reboot worked for me on CentOS 6.7.

To show the year in the output, so it actually makes sense if you have more than one year's worth of records, do

last -F reboot

Though I gather that the -F switch doesn't work on some systems, like Solaris. It's apparently part of GNU's last, though.

Thanks to https://unix.stackexchange.com/a/97597/174520


if you want to keep track of how long your computer has been up in the past you can use something like uptimed.

it comes with a program called uprecords that show you how long your computer has been on.


Here is a one-liner to list all messages from current day:

cat /var/log/messages | grep "`LC_ALL=en_en.utf8 date +"%b %e"`"

This was tested on CentOS so YMMV.

And of course there is last reboot and last shutdown (as mentioned), but this is too simple for my needs (only provides dates).


if no log is present, you may try to add some 'date >>mylog' to shutdown script(in some dists, it is called rc.shutdown)

or,there is also a way without previlage needed. run:

while [ 1 ];do sleep 5;date>mylog;sync;done

and tail mylog on next session.


Running Debian-

cat /var/log/auth.log | grep "powering down"

shows the last shutdown time.


You might find your answer here: How to check Linux shutdown and restart history

  • 2
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Oct 22, 2022 at 4:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .