Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can tell that my last shutdown was properly done in Ubuntu 11.10 or if the machine was powered off before shutting down the OS?

share|improve this question
Take a look at /var/log/syslog.0 – Gigili Feb 10 '12 at 12:20
up vote 17 down vote accepted

If the machine was shutdown properly then there must be a shutdown log logged in kern.log file in /var/log directory. After a shutdown whenever a normal boot occurs the OS writes the log for the same in kern.log. Hence every boot log must be preceded by a shutdown log if the booting and shutdown process was normal.

Whenever a normal shutdown occurs "Kernel logging (proc) stopped." is written in kern.log. Similarly whenever a boot occurs "imklog 5.8.1, log source = /proc/kmsg started." is written in kern.log

These two messages should be in the order if the shutdown was normal rather than abrupt power off. There should be no "imklog 5.8.1, log source = /proc/kmsg started." message without the "Kernel logging (proc) stopped." message if the previous shutdown was normal. The both message should always occur in pair in log.enter image description here

Just type in terminal :- gedit /var/log/kern.log

and check for the shutdown and boot log pairs. If they are found not in pairs anywhere that shutdown must have been abrupt.

share|improve this answer
replace gedit with your default text editor. – Vikramjeet Feb 28 '12 at 17:08
my kern.log is empty – Nade Oct 27 '13 at 18:29
@Nade try kern.log.1. – a different ben Oct 27 '13 at 22:50
neither of those phrases are in my log. Not even part of them. I really need to know if my computer's being shutdown properly b/c I believe I have a kid who's simply holding down the power button. – KI4JGT Dec 28 '13 at 4:44

Hi you can run a script to check if the last shutdown is peoper or not. Just put the following lines in a bash script and run it after a system boot up.

touch data_file
echo $(($(grep -nr "$(cat  /var/log/kern.log | grep "$(date -d $(who -b | awk '{printf $3}') '+%b %-d')" | grep imklog   | grep $(cat  /var/log/kern.log | grep "$(date -d $(who -b | awk '{printf $3}') '+%b %-d')" | grep imklog | cut -d' ' -f3 | sort -k1 -r | sort --unique --stable -k2,3))" /var/log/kern.log | awk '{printf $1}' | grep -oE "[[:digit:]]{1,}")-$B))  >  data_file

if [[

($(sed -n $(cat data_file)p /var/log/kern.log | awk '{print $6}') == "Kernel") && 
($(sed -n $(cat data_file)p /var/log/kern.log | awk '{print $7}') == "logging") &&
($(sed -n $(cat data_file)p /var/log/kern.log | awk '{print $8}') == "(proc)") &&
($(sed -n $(cat data_file)p /var/log/kern.log | awk '{print $9}') == "stopped.") 

]]; then

  echo Last Shutdown-proper


   echo Last Shutdown_not proper 


rm data_file

NOTE: Please be in a root user to run the script,It wont harm your system :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.