How to find the last system shutdown time?

Ans:

If you just need last shutdown; try using the command:

Code:

uptime
You can do some calculation with curent date-time to get the exact shutdown date.

Note: 
There might be few hours difference; as shutdown time and uptime would not be same; this difference of hours would be system downtime.  This may result in date change also, if shutdown occured around midnight or system downtime was fairly large.
 

Example 1:
uptime command would give the output in following format:

Quote:
01:40AM up X days, 9:33, 3 users ... 

You would need to subtract X days from current date to get the last reboot date.

Alternatively, You can use the following command to determine last reboot time, with year.

Code:

errpt -aj 2BFA76F6
2BFA76F6: happens to be an identifier for SYSTEM SHUTDOWN in AIX, and can be obtained using:

Code:

errpt | grep SHUT
 

Example 2:

Code:

trogdor ~ $ last -1x shutdown
shutdown system down  2.6.34.7-66.fc13 Sat Jan  8 20:20 - 20:29  (00:09)

wtmp begins Sun Aug 29 06:30:04 2010

Gives you the time of the last shutdown.

But:

Code:

trogdor ~ $ last -1x reboot
reboot   system boot  2.6.34.7-66.fc13 Sat Jan  8 20:29 - 10:18 (7+13:49) 

wtmp begins Sun Aug 29 06:30:04 2010

Shows the time of the last (re)boot, which corresponds to what is shown by uptime:

Code:

trogdor ~ $ uptime
 10:18:41 up 7 days, 13:49,  6 users,  load average: 0.03, 0.09, 0.08

You can use awk, sed, perl, and numerous other tools to extract and format the date and time of the last reboot to your liking. Please note that the year is not displayed.

You can parse /var/log/wtmp to get what you need. For instance, using the examples in Formatting and Printing Wtmp as a starting point:

Code:

#! /usr/bin/perl

use strict;
use warnings;
use POSIX qw{ strftime };

undef $/;

$\ = "\n";
$, = '';

my $reclen   = 384; # sizeof (struct utmp)
my $linesize =  32; # value of UT_LINESIZE in /usr/include/bits/utmp.h
my $namesize =  32; # value of UT_NAMESIZE in /usr/include/bits/utmp.h
my $hostsize = 256; # value of UT_HOSTSIZE in /usr/include/bits/utmp.h

my $wtmpfile = '/var/log/wtmp';

my $entry_template = "(a$reclen)*";
my $utmp_template  = "I x4 x$linesize x4 x$namesize x$hostsize x4 x4 I";

my @UT_TYPE  = qw{ Empty RunLvl Boot NewTime OldTime Init Login Normal Term Account };

open FH, '<', $wtmpfile or die $wtmpfile;

my $boot = undef;
foreach my $entry (unpack $entry_template, <FH>) {
    my ($type, $when) = unpack $utmp_template, $entry;
    $boot = $when if $UT_TYPE[$type] eq 'Boot';
}

close FH;
print strftime '%Y-%m-%d %H:%M:%S %Z', localtime $boot if defined $boot;

Will give you the time of the reboot:

Code:

trogdor ~ $ lastboot
2011-01-08 20:29:54 EST

Have a Linux Problem
Linux Forum - Do you have a Linux Question?

Linux Books
Linux Certification, System Administration, Programming, Networking Books

Linux Home: Linux System Administration Hints and Tips