| 45 | = Proper shutdown Log |
| 46 | Ref[https://access.redhat.com/articles/2642741 here] |
| 47 | |
| 48 | With a simple last -Fxn2 shutdown reboot command, the system wtmp file reports the two most recent shutdowns or reboots. reboot denotes the system booting up; whereas, shutdown denotes the system going down. |
| 49 | |
| 50 | A graceful shutdown would show up as a reboot line followed by shutdown line, as in the following example: |
| 51 | {{{ |
| 52 | ~]# last -Fxn2 shutdown reboot |
| 53 | reboot system boot 4.18.0-80.el8.x8 Mon Aug 31 06:33:11 2020 still running |
| 54 | shutdown system down 4.18.0-80.el8.x8 Mon Aug 31 06:33:01 2020 - Mon Aug 31 06:33:11 2020 (00:00) |
| 55 | }}} |
| 56 | |
| 57 | An ungraceful shutdown can be inferred by the omission of shutdown; instead there will either be a single reboot line (if the wtmp file had been truncated/rotated prior to the crash) or 2 reboot lines in a row, as in this example: |
| 58 | {{{ |
| 59 | ~]# last -Fxn2 shutdown reboot |
| 60 | reboot system boot 4.18.0-147.5.1.e Tue Sep 1 07:16:25 2020 still running |
| 61 | reboot system boot 4.18.0-147.5.1.e Mon Aug 3 07:10:56 2020 still running |
| 62 | }}} |
| 63 | |
| 64 | |