Unix & Linux: How to find out from the logs what caused system shutdown? (10 Solutions!!)
Channel: Roel Van de Paar
Date: 06/08/2020

Unix & Linux: How to find out from the logs what caused system shutdown?


The Question: E.g. I'm seeing this in /var/log/messages:
Mar 01 23:12:34 hostname shutdown: shutting down for system halt
Is there a way to find out what caused the shutdown? E.g. was it run from
console, or someone hit power button, etc.?

Solutions: Please watch the whole video to see all solutions, in order of how many people found them helpful

== This solution helped 4 people ==
I have just a clumsy idea, but maybe it works for you: enter the command last
and check out the login informations for all of the users. then, filter th
users with the permission required for halt that had been logged in at that
moment. then check out their .bash_history file to see if they have entered
halt or not.

== This solution helped 12 people ==
Some possible log files to explore: (found a Ubuntu system, but I would hope
that they're present on most Linux/Unix systems)
/var/log/debug
/var/log/syslog (will be pretty full and may be harder to browse)
/var/log/user.log
/var/log/kern.log
/var/log/boot
Again, these log files are present on a Ubuntu system, so filenames may be
different. The tail command is your friend.

== This solution helped 128 people ==
Try the following commands:
Display list of last reboot entries: last reboot | less
Display list of last shutdown entries: last -x | less
or more precisely: last -x | grep shutdown | less
You won't know who did it however. If you want to know who did it, you will
need to add a bit of code which means you'll know next time.
I've found this resource online. It might be useful to you:
https://web.archive.org/web/20170904210829/http://scofaq.aplawrence.com:80/
FAQ_scotec1haltcatch.html

== This solution helped 51 people ==
Only root privileged programs can gracefully shutdown a system. So when a
system shuts down in a normal way, it is either a user with root privileges or
an acpi script. In both cases you can find out by checking the logs. An acpi
shutdown can be caused by power button press, overheating or low battery
(laptop). I forgot the third reason, UPS software when power supply fails,
which will send an alert anyway.
Recently I had a system that started repeatedly to power off ungracefully,
turned out that it was overheating and the mobo was configured to just power
off early. The system didn't have a chance to save logs, but fortunately
monitoring the system's temperature showed it was starting to increase just
before powering off.
So if it is a normal shutdown it will be logged, if it is an intrusion... good
luck, and if it is a cold shutdown your best chance to know is to control and
monitor its environment.

alias the shutdown to a script
the script must give all the parameters, etc to the original shutdown
executable
BUT: the script must log those this

== This solution helped 8 people ==
Simplify using last displaying the system shutdown entries and run level
changes and filtering on shutdown and reboot:
last -x shutdown reboot

With thanks & praise to God, and with thanks to the many people who have made this project possible! | Content (except music & images) licensed under cc by-sa 3.0 | Music: https://www.bensound.com/royalty-free-music | Images: https://stocksnap.io/license & others | With thanks to user stolsvik (https://unix.stackexchange.com/users/16159), user Stephane Gourichon (https://unix.stackexchange.com/users/19643), user sazary (https://unix.stackexchange.com/users/5945), user Nicolas de Fontenay (https://unix.stackexchange.com/users/6184), user ndemou (https://unix.stackexchange.com/users/73271), user luandrea (https://unix.stackexchange.com/users/157896), user LanceBaynes (https://unix.stackexchange.com/users/6960), user jhvaras (https://unix.stackexchange.com/users/46835), user forcefsck (https://unix.stackexchange.com/users/5666), user alfonx (https://unix.stackexchange.com/users/64733), user alex (https://unix.stackexchange.com/users/1946), and the Stack Exchange Network (http://unix.stackexchange.com/questions/9819). Trademarks are property of their respective owners. Disclaimer: All information is provided "AS IS" without warranty of any kind. You are responsible for your own actions. Please contact me if anything is amiss at Roel D.OT VandePaar A.T gmail.com.