As a system administrator, it's your responsibility to keep the system up and running to avoid any service disruptions. However, sometimes, there are situations when your system shuts down or reboots. This can be due to the system unexpectedly losing power or some user intentionally rebooting it.

Whatever the reason is, you can check your Linux system's shutdown and restart history to see when this activity exactly happened. This information will provide you with a starting point to begin the troubleshooting.

Check Linux System's Shutdown and Restart History

Here are some methods to check the shutdown and restart history in Linux using the command line:

1. Using the last Command

The last command in Linux lists the history of all users who have logged in and out of the Linux system with the most recent entry at the top. It obtains this information from the wtmp file which maintains a log of every login and logout event. You can check the shutdown history in your Linux system using the last command as follows: 

        last -x -F shutdown

Each entry in the output shows two timestamps where the first timestamp is for system shutdown and the second is for system startup. It also shows the duration for which the system kept running.

last shutdown

You can also check the last specific number of shutdown events using the -n flag. For instance, to check the last three shutdown events, the command would be: 

        last -x -F -n 3 shutdown

To check the restart history in your Linux system, use the following command: 

        last -x -F reboot

Each entry in the output shows two timestamps where the first timestamp is for the system startup and the second is for the system shutdown.

last reboot

To check the last specific number of restart events, use the -n flag with the last command. For instance, to check the last three restart events, the command would be: 

        last -x -F -n 3 reboot

2. Using the tuptime Command

The tuptime tool displays the history and statistics of all the shutdowns and restarts of a Linux system. You can install this tool on any Linux distribution using the following one-liner script: 

        bash < <(curl -Ls https://git.io/tuptime-install.sh)

Once installed, you can use the tuptime tool to check the shutdown and restart history in your Linux system as follows: 

        tuptime -t

This command lists the history of restarts and shutdowns with the most recent entry at the bottom.

tuptime output

To list only the last specific number of entries, you can pipe the output of the tuptime command to the tail command. For instance, to list the last three entries, the command would be: 

        tuptime -t | tail -3

3. Using the who Command

The who command in Linux shows information about the users who are logged in to your system. You can use the who command with the -b flag to display when your system last booted: 

        who -b
who command in Linux

4. Using the journalctl Command

The journalctl command is used to query and view logs collected by systemd. You can check your shutdown and restart history using the journalctl command with the --list-boots flag: 

        journalctl --list-boots

It returns the list of system boots with the most recent entry at the bottom, numbered 0. The first timestamp in the output shows the system startup time whereas the second timestamp shows the system shutdown time.

journalctl command output

Troubleshooting Errors Is Much Easier on Linux

While you can't really identify the reason for your system shutdown or reboot using these methods, information on when your system was rebooted or shut down can help you in troubleshooting the issues.