If system shutdown abruptly. Then will it be possible to tell at what time it was shut ? Abruptly means due to power failure or due to sysrq magic keys. If I am logging something every few seconds then I will have answer but if not then is there any way ?

I am using customized console-based system. Kernel is 5.3

1 Answer 1


You can tell when the system was restarted in number of ways... "uptime", "last reboot", etc. Telling when it was shutdown is a bit more troublesome. Assuming you have regular system logging via rsyslogd running, you could use module immark as your "logging something every few seconds" routine by adding the following to /etc/rsyslogd.conf:

$ModLoad immark
$MarkMessagePeriod <your time granularity here, in seconds>
$ActionWriteAllMarkMessages on

You can also not bother, and can rather look at one of two things in the messages file. If the file is rotated at system boot, you can simply look at the date on the previous version of the file using 'ls -l' to give you pretty good guess as to when the system stopped writing to it. If you don't rotate the system log, you can achieve the same accuracy by looking at the timestamp of the line just before the line indicating restart. Our restarts look a bit like this:

2020-03-29T03:20:01.529437-04:00 [hostname] rsyslogd: [origin software="rsyslogd" swVersion="8.24.0-41.el7_7.2" x-pid="1615" x-info="h
ttp://www.rsyslog.com"] rsyslogd was HUPed

If the shutdown wasn't unexpected, it gets easier, as the system logger will write a message to the log before it dies.

If you've turned off system logging, this all becomes moot of course. If you're still logging things to system logs, you can grab the stats of some of the files there and figure out roughly when the system went away by looking at the Modified times:

root# stat /var/log/messages-01.gz
  File: '/var/log/messages-01.gz'
  Size: 185529          Blocks: 368        IO Block: 4096   regular file
Device: fd06h/64774d    Inode: 12689803    Links: 1
Access: (0640/-rw-r-----)  Uid: (    0/    root)   Gid: (658178/  mssgro)
Access: 2020-04-08 10:27:47.691311523 -0400
Modify: 2020-04-05 03:01:34.000000000 -0400  <=== that's what you're after ==
Change: 2020-04-07 18:16:40.252668164 -0400
 Birth: -

Pick the latest one from the files you choose and you've got a pretty good estimate of when the system stopped.

Just some ideas, hope they help.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .