Where does Linux store the shutdown messages from last shutdown?

  • It doesn't. For Debian based distros (Ubuntu etc), see here for how to read them.
    – Graeme
    Aug 3 '14 at 18:27

The shutdown messages you see on the screen may or may not have been logged. If they happen after the root filesystem is unmounted, they obviously can't be -- there's no where to save them at that point.

What there is could be anywhere (or nowhere) but usually you will find it in either /var/log/messages or /var/log/syslog. An easy way to do this, presuming the system has since been rebooted, is to look for the 0.000000 timestamp used by the kernel when it starts, and scroll back.

For example, if you load less /var/log/syslog and go to the end with CtrlEnd(if it says "Waiting...", give it a second or two then ctrl-c to stop waiting), you can search backward with ? and the pattern 0.000+]. There will be a long sequence of lines with that in it. Right before the first one you'll probably see to something to the effect that the system logger has started. The stuff right before that is from the last shutdown.

  • I do not have have the syslog file. If it matters, this is Fedora with systemd
    – user75027
    Aug 3 '14 at 19:01
  • You should have a /var/log/messages. You can create a /var/log/syslog to get a higher level of detail by adding *.* -/var/log/syslog to /etc/rsyslog.conf (under ## RULES ##) and restarting the logger, sudo systemctl restart rsyslog.
    – goldilocks
    Aug 3 '14 at 19:17
  • None of these files are where you say they are for me. I can not find /etc/rsyslog.conf, so do I just make it?
    – user75027
    Aug 3 '14 at 20:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.