Linux: Find Out Last System Reboot Time and Reason / Linux / CentOS / Linux: Find Out Last System Reboot Time and Reason

Rebooting a Linux device can happen for several reasons. This could be a normal restart of the operating system by the user, an automatic installation of updates, kernel panics, physical hardware failures, software errors, or a power failure.

If your Linux server has rebooted unplanned, there are several ways to find out why and check the cause.

Get operating system boot time:

$ who -b

system boot 2023-10-26 09:07

You can also use the last command to display information about host reboots:

$ last -x | head | tac

List of recent Linux reboots from the logs:

$ journalctl --list-boots

linux: journalctl --list-boots

Or the entire reboot history:

$ last reboot

To find out the reasons for a particular restart, run the command

$ journalctl -b {num}-n

Replace {num} with the entry index in the output of journalctl –list-boots command.

In my example, you can see that the reboot of the host has been initiated by a cron job that performs an automatic update of the HestiaCP web panel.

How to find out who/what caused a Linux reboot

In some cases, you may need to analyze log files to get information about why Linux rebooted.

  • CentOS/RHEL/Rocky/Oracle Linux –/var/log/message
  • Ubuntu/Debian – /var/log/syslog

To quickly find the reasons for the reboot in the system logs, use the following bash script:

$ sudo grep -iv ': starting\|kernel: .*: Power Button\|watching system buttons\|Stopped Cleaning Up\|Started Crash recovery kernel' \
 /var/log/messages /var/log/syslog /var/log/apcupsd* \
 | grep -iw 'recover[a-z]*\|power[a-z]*\|shut[a-z ]*down\|rsyslogd\|ups'

In my example, the log contained the following line

systemd[1]: Started Unattended Upgrades Shutdown.

This means that automatic unattended upgrading is enabled for this Ubuntu host (you can disable it as follows).

Leave a Reply

Your email address will not be published. Required fields are marked *