0

I am trying to view a log of previous bootups. The following command does exactly what I want it to do

last -x | grep shutdown

with the only limitation being that it only displays events within the current month. Being November 6, this gives me only 6 days to see.

I would like to view events from say, October 30th or earlier. Is there any way to do this?

1 Answer 1

2

last reads the file /var/log/wtmp, but you can point it to another file. In your case that would be /var/log/wtmp.1.

So, the modified command that you need to use is

last -x -f /var/log/wtmp.1 | grep shutdown
5
  • This is awesome! thank you. my one question is this: when using my initial command, i see 1 shutdown on Nov. 4, 4 from Nov. 2, and 2 from Nov. 1. when using your command, it starts with the 2 of Nov. 1. Just wondering if it only removed those 5 entries, or if there are others missing as well, and why
    – Blaine
    Nov 6, 2015 at 11:13
  • 1
    I don't really know, I have the same output... But I'm on 14.04! Maybe that means something (maybe a bug in 12.04, then corrected?)
    – dadexix86
    Nov 6, 2015 at 11:15
  • could be because you used last -x -f /var/log/wtmp | grep shutdown instead of last -x -f /var/log/wtmp.1 | grep shutdown?
    – Blaine
    Nov 6, 2015 at 11:18
  • Oh, I'm sorry. I misinterpreted what you wrote. In principle, there should be no intersection at all with the two commands.
    – dadexix86
    Nov 6, 2015 at 12:39
  • sorry, it was a confusing comment. I'll try to upload the output of the commands later to show what i mean
    – Blaine
    Nov 7, 2015 at 7:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .