Find last system shut down time

Linux and Unix-Like Linux
1

Hi,

I need to find the last system shutdown time. I got a command last that is used for this.But the command is not give the year. Below i posted the sample output

last -x |grep shutdown
shutdown system down  2.6.31.5-server- Tue Jan 11 11:45 - 11:46  (00:00)
shutdown system down  2.6.31.5-server- Sat Dec 11 11:25 - 11:45 (31+00:20)
shutdown system down  2.6.31.5-server- Mon Jan 10 21:04 - 10:31  (13:27)
shutdown system down  2.6.31.5-server- Fri Jan  7 17:38 - 11:05 (2+17:26)
shutdown system down  2.6.31.5-server- Thu Jan  6 20:39 - 10:00  (13:21)
shutdown system down  2.6.31.5-server- Wed Jan  5 19:48 - 10:46  (14:58)
shutdown system down  2.6.31.5-server- Tue Jan  4 20:13 - 09:51  (13:38)

year field is important for me. how can i get that?

Guide me.

2

If you just need last shutdown; try using the command:

uptime

you can do some calculation with curent date-time to get the exact shutdown date.

Note: There might be few hours difference; as shutdown time and uptime would not be same; this difference of hours would be system downtime.
This may result in date change also, if shutdown occured around midnight or system downtime was fairly large.

Hope this helps.

3

Thanks for your reply

uptime command gives only how long the system is running. By uptime result, we can only decide when the system is started exactly.

How can we calculate system last down time using uptime result?

Gudie me.

---------- Post updated 01-12-11 at 01:28 AM ---------- Previous update was 01-11-11 at 07:23 AM ----------

Hi, any update on this.

4

uptime command would give the output in following format:

You would need to subtract X days from current date to get the last reboot date.

Alternatively, You can use the following command to determine last reboot time, with year.

errpt -aj 2BFA76F6

2BFA76F6: happens to be an identifier for SYSTEM SHUTDOWN in AIX, and can be obtained using:

errpt | grep SHUT
5

Thanks for your reply.

But i need for Linux system. What command is used to get?

6

Have a look at the "fwtmp" command. This can be used to read the file which "last" uses and outputs the history in text format - including the full date.

7

You are correct, maruthu:

trogdor ~ $ last -1x shutdown
shutdown system down  2.6.34.7-66.fc13 Sat Jan  8 20:20 - 20:29  (00:09)

wtmp begins Sun Aug 29 06:30:04 2010

Gives you the time of the last shutdown.

But:

trogdor ~ $ last -1x reboot
reboot   system boot  2.6.34.7-66.fc13 Sat Jan  8 20:29 - 10:18 (7+13:49)   

wtmp begins Sun Aug 29 06:30:04 2010

Shows the time of the last (re)boot, which corresponds to what is shown by uptime:

trogdor ~ $ uptime
 10:18:41 up 7 days, 13:49,  6 users,  load average: 0.03, 0.09, 0.08

You can use awk, sed, perl, and numerous other tools to extract and format the date and time of the last reboot to your liking. Please note that the year is not displayed.

You can parse /var/log/wtmp to get what you need. For instance, using the examples in Formatting and Printing Wtmp as a starting point:

#! /usr/bin/perl

use strict;
use warnings;
use POSIX qw{ strftime };

undef $/;

$\ = "\n";
$, = '';

my $reclen   = 384; # sizeof (struct utmp)
my $linesize =  32; # value of UT_LINESIZE in /usr/include/bits/utmp.h
my $namesize =  32; # value of UT_NAMESIZE in /usr/include/bits/utmp.h
my $hostsize = 256; # value of UT_HOSTSIZE in /usr/include/bits/utmp.h

my $wtmpfile = '/var/log/wtmp';

my $entry_template = "(a$reclen)*";
my $utmp_template  = "I x4 x$linesize x4 x$namesize x$hostsize x4 x4 I";

my @UT_TYPE  = qw{ Empty RunLvl Boot NewTime OldTime Init Login Normal Term Account };

open FH, '<', $wtmpfile or die $wtmpfile;

my $boot = undef;
foreach my $entry (unpack $entry_template, <FH>) {
    my ($type, $when) = unpack $utmp_template, $entry;
    $boot = $when if $UT_TYPE[$type] eq 'Boot';
}

close FH;
print strftime '%Y-%m-%d %H:%M:%S %Z', localtime $boot if defined $boot;

will give you the time of the reboot:

trogdor ~ $ lastboot
2011-01-08 20:29:54 EST