# How to find out if computer was shut down at a given time?

On Ubuntu (14/16) is there anyway to find out if computer was running at a given time? (e.g. last night at 10 pm if the computer was running or turned off) thanks

last -x | less


will show both shutdown and time of booting:

runlevel (to lvl 5)   3.19.0-71-generi Mon Oct 17 08:40 - 12:30 (4+03:50)
reboot   system boot  3.19.0-71-generi Mon Oct 17 08:39 - 12:30 (4+03:51)
shutdown system down  3.19.0-71-generi Fri Oct 14 17:02 - 08:39 (2+15:36)
{user}   :0           :0               Fri Oct 14 07:47 - down   (09:15)
runlevel (to lvl 5)   3.19.0-71-generi Fri Oct 14 07:47 - 17:02  (09:15)
reboot   system boot  3.19.0-71-generi Fri Oct 14 07:46 - 17:02  (09:15)
...
runlevel (to lvl 5)   3.19.0-69-generi Mon Oct 10 08:32 - 07:47 (3+23:14)
reboot   system boot  3.19.0-69-generi Mon Oct 10 08:31 - 17:02 (4+08:30)
shutdown system down  3.19.0-69-generi Fri Oct  7 16:49 - 08:31 (2+15:41)


Simply give the following command in the terminal:

last -1x shutdown


Last Shutdown will be displayed:

shutdown system down  3.19.0-65-generi Fri Oct 21 04:37 - 15:02  (10:24)
wtmp begins Sat Oct  1 21:53:26 2016


Update:

As Rizwind said and answered that, to show when it was last booted and shutdown to prove running at a given time, the following command will show the both:

last -x | less

• That is 1/2 the answer. "if computer was running at a given time?" You also need to show when it was booted after that shutdown to prove it was running at a given time. – Rinzwind Oct 21 '16 at 10:29

# Use syslog.1 to find hours system was running yesterday

If for example you wanted to know the hours your system was running yesterday you could use this command:

rick@dell:~\$ grep cron.hourly /var/log/syslog.1

Oct 20 04:17:01 dell CRON[16062]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Oct 20 05:17:01 dell CRON[23665]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Oct 20 18:17:01 dell CRON[11680]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Oct 20 19:17:01 dell CRON[19789]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Oct 20 20:17:01 dell CRON[16936]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Oct 20 21:17:01 dell CRON[24757]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Oct 20 22:17:01 dell CRON[32481]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)


It shows us the system was active at 4 am and 5 am. Then it was active again at 6 pm, 7 pm, 8 pm, 9 pm and your magic number 10 pm represented by "22:17:01".

This methodology requires knowledge of system log files stored in /var/log and some commands such as cron which can be setup to run hourly. You could search for other commands such as wifi, print jobs, etc.

My system is a laptop that doesn't actually shutdown but rather suspends and resumes when the lid is closed and opened so the solution needs to be different than the other answers offered so far.