Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When my system starts up it logs everything into syslog/dmesg. And I can review it for problems.

When my system shuts down, where does that get logged? I didn't see anything obvious in /var/log in 10.04. (My 11.10 system is out of reach at the moment.)

I looked at How do I turn on 'shutdown logging' or operating system tracing? but didn't see anything that helped.

I use kubuntu, but all of the stuff at this level is probably the same.

share|improve this question

Shutdown operations are logged in /var/log/syslog.

tail -f /var/log/syslog

share|improve this answer
Well, maybe. First, syslog is huge and i don't understand most of the entries, so it's hard to find the actual shutdown sequence. Second, if I'm shutting down, tail will get terminated and so will my terminal. If I look at syslog.1 or the zipped versions I can get past that, but I still don't know what I'm looking for. – Joe Jan 6 '12 at 9:19

Never did find the answer to this, but I made my own alternative.

I created rc.local_jjp in /etc

#!/bin/sh -e
# rc.local_jjp
# This script is executed at the start of runlevel 0 and 6
#    and at the end of runlevels 1,2 and 3
# Make sure that the script will "exit 0" on success or any other
# value on error.


case "$1" in
    echo "System Shutdown at $DATE" >> $LOG
    echo "System Restart at $DATE" >> $LOG
    echo "Usage: $0 {start|stop|restart}" >> $LOG
    exit 1

exit 0

Then, I symlinked it into the runlevel directories.

sudo ln -s /etc/rc.local_jjp /etc/rc0.d/K02rc.local_jjp
sudo ln -s /etc/rc.local_jjp /etc/rc1.d/S99rc.local_jjp
sudo ln -s /etc/rc.local_jjp /etc/rc2.d/S99rc.local_jjp
sudo ln -s /etc/rc.local_jjp /etc/rc3.d/S99rc.local_jjp
sudo ln -s /etc/rc.local_jjp /etc/rc6.d/K02rc.local_jjp

(I wasn't really clear on what runlevels 4 and 5 do, so I didn't add symlinks for them.)

Now, I have my own little syslog which shows startups and shutdowns.

I won't say much about Linux startup and shutdown behavior (mainly because I don't understand it that well), but the basic idea is that scripts in special directories get executed when the system changes runlevel such as when it changes from boot up to multiuser (runlevel 3).

Since my script needs the system to be running normally and because I don't want to chance interfering with something important, I named the symlinks so that it would get executed as one of the last things on startup and one of the first things on shutdown.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.