33

How can tell that my last shutdown was properly done in Ubuntu 11.10 or if the machine was powered off before shutting down the OS?

Bruno Pereira
  • 73,643
Vikramjeet
  • 5,566

5 Answers5

25

If the machine was shutdown properly then there must be a shutdown log logged in kern.log file in /var/log directory. After a shutdown whenever a normal boot occurs the OS writes the log for the same in kern.log. Hence every boot log must be preceded by a shutdown log if the booting and shutdown process was normal.

Whenever a normal shutdown occurs "Kernel logging (proc) stopped." is written in kern.log. Similarly whenever a boot occurs "imklog 5.8.1, log source = /proc/kmsg started." is written in kern.log

These two messages should be in the order if the shutdown was normal rather than abrupt power off. There should be no "imklog 5.8.1, log source = /proc/kmsg started." message without the "Kernel logging (proc) stopped." message if the previous shutdown was normal. The both message should always occur in pair in log.enter image description here

Just type in terminal :-

gedit /var/log/kern.log

and check for the shutdown and boot log pairs. If they are found not in pairs anywhere that shutdown must have been abrupt.

d a i s y
  • 5,511
Vikramjeet
  • 5,566
  • 1
    replace gedit with your default text editor. – Vikramjeet Feb 28 '12 at 17:08
  • 1
    my kern.log is empty – Nade Oct 27 '13 at 18:29
  • 2
    @Nade try kern.log.1. – a different ben Oct 27 '13 at 22:50
  • 2
    neither of those phrases are in my log. Not even part of them. I really need to know if my computer's being shutdown properly b/c I believe I have a kid who's simply holding down the power button. – KI4JGT Dec 28 '13 at 04:44
  • 1
    as of Ubunutu 16.04 this seems no longer correct. i.e. I don't get cat /var/log/syslog | grep -i "stopped" (and similar. also sanity-tested the contrary), despite that this was clearly part of the previous shutdown messages... (the visible log stuff, when pressing ESC to kill the splash screen while shutting down) - anyone got an update? – Frank N Oct 27 '16 at 03:41
  • I can confirm the answer no longer works for recent versions of Ubuntu. – TommyPeanuts Oct 19 '23 at 07:20
7

I use the last command. It lists reboots and crashes.

Zanna
  • 70,465
Adam Felson
  • 79
  • 1
  • 3
3

As of Ubuntu 16.04, a clean shutdown followed by a proper reboot will write these 2 lines one after the other in /var/log/syslog 

Mar  9 14:14:06 *YOUR-HOSTNAME* rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="1086" x-info="http://www.rsyslog.com"] exiting on signal 15.
Mar  9 15:23:42 *YOUR-HOSTNAME* rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="1069" x-info="http://www.rsyslog.com"] start
Victorvg
  • 47
  • 1
    This is no longer the case in Ubuntu 20.04. I don't have any mention of rsyslogd. Oh, and the final log entry on shutdown is systemd[1]: Stopped QEMU KVM preparation - module, ksm, hugepages. due to my installing virsh stuff on it. – John Nov 01 '21 at 08:51
1

I'm running Ubuntu 22.04. I found the following was the easiest method:

last -Fxn2 shutdown reboot

Note that last shows things in reverse order, but a clean shutdown will show a shutdown followed by a boot (which will still be running):

reboot   system boot  5.15.0-86-generi Thu Oct 19 01:02:05 2023   still running
shutdown system down  5.15.0-84-generi Thu Oct 19 03:03:23 2023 - Thu Oct 19 03:03:30 2023  (00:00)

A power outage or other disorderly stop will show reboots only, with no intervening shutdowns in between them:

reboot   system boot  5.15.0-86-generi Thu Oct 19 01:02:05 2023   still running
reboot   system boot  5.15.0-86-generi Tues Aug 04 13:12:09 2023   still running

More information and other methods can be found here:

https://access.redhat.com/articles/2642741

TommyPeanuts
  • 1,079
0

Hi you can run a script to check if the last shutdown was proper or not. Just put the following lines in a bash script and run it after a system boot up.

#!/bin/bash
B="1"
touch data_file
echo $(($(grep -nr "$(cat  /var/log/kern.log | grep "$(date -d $(who -b | awk '{printf $3}') '+%b %-d')" | grep imklog   | grep $(cat  /var/log/kern.log | grep "$(date -d $(who -b | awk '{printf $3}') '+%b %-d')" | grep imklog | cut -d' ' -f3 | sort -k1 -r | sort --unique --stable -k2,3))" /var/log/kern.log | awk '{printf $1}' | grep -oE "[[:digit:]]{1,}")-$B))  >  data_file


if [[

($(sed -n $(cat data_file)p /var/log/kern.log | awk '{print $6}') == "Kernel") && 
($(sed -n $(cat data_file)p /var/log/kern.log | awk '{print $7}') == "logging") &&
($(sed -n $(cat data_file)p /var/log/kern.log | awk '{print $8}') == "(proc)") &&
($(sed -n $(cat data_file)p /var/log/kern.log | awk '{print $9}') == "stopped.") 


]]; then

  echo Last Shutdown-proper

else

   echo Last Shutdown_not proper 

fi

rm data_file

NOTE: Please be in a root user to run the script. It won't harm your system :)

Rockhorse Park
  • 7
Sid
  • 49
  • 1
  • 1
  • 6