Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

E.g. I'm seeing this in /var/log/messages:

Mar 01 23:12:34 hostname shutdown: shutting down for system halt

Is there a way to find out what caused the shutdown? E.g. was it run from console, or someone hit power button, etc.?

share|improve this question
So this time a had some luck with /var/log/acpid: turned out the power button was hit. Any other ideas, where to look if acpid doesn't give a clue? – alex Mar 21 '11 at 19:20
up vote 16 down vote accepted

Only root privileged programs can gracefully shutdown a system. So when a system shuts down in a normal way, it is either a user with root privileges or an acpi script. In both cases you can find out by checking the logs. An acpi shutdown can be caused by power button press, overheating or low battery (laptop). I forgot the third reason, UPS software when power supply fails, which will send an alert anyway.

Recently I had a system that started repeatedly to power off ungracefully, turned out that it was overheating and the mobo was configured to just power off early. The system didn't have a chance to save logs, but fortunately monitoring the system's temperature showed it was starting to increase just before powering off.

So if it is a normal shutdown it will be logged, if it is an intrusion... good luck, and if it is a cold shutdown your best chance to know is to control and monitor its environment.

share|improve this answer

Try the following commands:

Display list of last reboot entries: last reboot | less

Display list of last shutdown entries: last -x | less

or more precisely: last -x | grep shutdown | less

You won't know who did it however. If you want to know who did it, you will need to add a bit of code which means you'll know next time.

I've found this resource online. It might be useful to you:

How to find out who or what halted my system

share|improve this answer
Well, this doesn't tell me what caused the shutdown, only when it was done. Which I already know, see my question. – alex Apr 5 '11 at 6:22
more precisely last -x shutdown – Rahul Patil Jun 10 '13 at 5:49

Some possible log files to explore: (found a Ubuntu system, but I would hope that they're present on most Linux/Unix systems)

/var/log/syslog (will be pretty full and may be harder to browse)

Again, these log files are present on a Ubuntu system, so filenames may be different. The tail command is your friend.

share|improve this answer

I have just a clumsy idea, but maybe it works for you: enter the command last and check out the login informations for all of the users. then, filter th users with the permission required for halt that had been logged in at that moment. then check out their .bash_history file to see if they have entered halt or not.

share|improve this answer

Simplify using last displaying the system shutdown entries and run level changes and filtering on shutdown and reboot:

last -x shutdown reboot
share|improve this answer
ndefontenay already mentioned that. Thank you for contributing, but please read the existing answers first. – Gilles Dec 23 '13 at 15:30
I though my answer simplified ndefontenay one, but thanks. – jhvaras Dec 23 '13 at 16:15
@gilles I gotta say this is subtly different, in the cat foo | grep bar vs grep bar foo sort of way, it appears that last is capable of filtering itself. – xenoterracide Dec 26 '13 at 18:41

Not fully satisfying

I had a similar need on a Debian 7.8 and observe that basically there's no clear and explicit message in log, which is a little surprising.

Grep through /var/log would tell the time the machine was shut down, show proper daemons shutdown, etc, but not the initial reason.

shutdown[25861]: shutting down for system halt

The other solutions mentioned (last -x) did not help much.

Looking how it works

Reading /etc/acpi/powerbtn-acpi-support.sh which includes:

if [ -x /etc/acpi/powerbtn.sh ] ; then
    # Compatibility with old config script from acpid package
elif [ -x /etc/acpi/powerbtn.sh.dpkg-bak ] ; then
        # Compatibility with old config script from acpid package
    # which is still around because it was changed by the admin
    # Normal handling.
    /sbin/shutdown -h -P now "Power button pressed"

Notice that an explicit text is given as parameter of the shutdown command. I would expect that string to be logged automatically by the shutdown program.

Adjusting for better logs

Anyway, to get an explicit message I put the text below (as root) in a newly created /etc/acpi/powerbtn.sh made executable with chmod a+x /etc/acpi/powerbtn.sh

logger in /etc/acpi/powerbtn.sh, presumably "Power button pressed"
    /sbin/shutdown -h -P now "Power button pressed"

Doing it this way will probably make a longer lasting change than modifying /etc/acpi/powerbtn-acpi-support.sh. The latter option would probably lose its effect on next upgrade of package acpi-support-base.

Notice than Ubuntu 14.04 does it differently (/etc/acpi/powerbtn.sh already exists with different content from acpid package). Also, Debian 8 probably does it differently. Feel free to offer variants.


And now when the power button is pressed, a line like below appears in /var/log/messages, /var/log/syslog and /var/log/user.log:

logger: in /etc/acpi/powerbtn.sh, presumably Power button pressed

Now that's an explicit message in the log.

share|improve this answer

alias the shutdown to a script
the script must give all the parameters, etc to the original shutdown executable
BUT: the script must log those this

share|improve this answer
The shutdown script does this already (last -x) – forcefsck Apr 2 '11 at 21:33

In my case I had a problem of overheating and found the log in /var/log/syslog by a 'grep shut *' in /var/log folder.

The error logged was this:

Feb 23 15:59:49 luca-LIFEBOOK-A530 kernel: [24746.497174] thermal thermal_zone0: critical temperature reached(99 C),shutting down
share|improve this answer

In systems with ext4 partitions I've noticed that a line like EXT4-fs ...: INFO: recovery required ... is logged only after a forced power off because the kernel notices that the ext4 filesystem was not cleanly unmounted. I guess all other filesystems will also log something on the same lines.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.