6 ways to Check System Reboot Logs on Linux

When working with Red Hat-based systems (like RHEL, CentOS, or Fedora), it’s important to be able to check when the system was rebooted and understand the reasons behind it.

System reboots can happen for various reasons such as updates, crashes, manual reboots, or hardware failures. Here’s how you can check the reboot logs on Red Hat systems.

1. Using journalctl to Check Reboot Logs

journalctl is the log management tool used by systemd, the system and service manager. In Red Hat and other systemd-based distributions (like CentOS 7 and above), it manages logs for the entire system.

To check the logs for the last reboot, use the following command:

journalctl -b -1

• -b -1 indicates the logs from the previous boot (last reboot).
• You can use -b -2, -b -3, etc., to look at earlier boots.

Example:

journalctl -b -1

The output might look like:

-- Logs begin at Thu 2023-01-01 08:00:00 UTC, end at Fri 2023-01-02 08:00:00 UTC. --
Jan 02 08:05:23 myserver systemd[1]: Started My Application.
Jan 02 08:05:24 myserver systemd[1]: Stopping My Application...
Jan 02 08:05:25 myserver systemd[1]: Reached target Shutdown.
Jan 02 08:05:26 myserver systemd[1]: Reached target Reboot.

This command shows the logs before, during, and after the system restart, including services being stopped and the system reaching the “Reboot” target.

2. Check /var/log/messages File

The /var/log/messages file contains a variety of system logs, including hardware, kernel, and service-related messages. It often contains information on when a reboot occurred, including the reason for the reboot.

You can filter the logs related to system reboots by using:

grep reboot /var/log/messages

This command will show you all the entries related to a reboot event.

Example:

grep reboot /var/log/messages

Output might look like:

Jan  2 08:05:24 myserver systemd: Rebooting...
Jan  2 08:05:25 myserver kernel: reboot: system reboot

These logs indicate that the system performed a reboot at 08:05:24.

3. Check /var/log/boot.log File

The /var/log/boot.log file contains detailed logs during the boot process, which includes the kernel startup, device initialization, and service starts. If the reboot was triggered manually or due to a hardware/system issue, this log might provide more insights.

You can view the contents with:

cat /var/log/boot.log

Or:

less /var/log/boot.log

This log file shows the complete process during system boot-up, which could help you trace any abnormalities or reasons behind the reboot.

4. Use last Command for Reboot History

The last command shows a list of all logins, logouts, and system reboots. It can be used to track the history of system reboots.

To check the reboot history, run:

last reboot

This will display the reboot history along with the date, time, and the system’s uptime.

Example:

reboot   system boot  5.14.0-70-generic Thu Jan  2 08:05 still running

This indicates that the system was rebooted on January 2 at 08:05 and is still running.

5. Check dmesg Logs

dmesg displays the kernel buffer logs, including hardware events, system boot events, and errors. If the reboot was caused by a hardware failure or critical error, you might find relevant logs in dmesg.

To filter dmesg logs related to a reboot, use:

dmesg | grep -i reboot

This will display kernel-level messages related to the reboot event.

6. Check Hardware Failure Logs (if applicable)

If the reboot was caused by a hardware issue (such as power failure, disk errors, etc.), Red Hat might log this in /var/log/messages or other system logs. Hardware failure logs typically contain error messages or warnings related to hardware problems like disk failures, power issues, or temperature alarms.

You can search for hardware-related error messages in:

grep -i 'error' /var/log/messages

This may provide insights into whether the reboot was caused by hardware failure.

Summary

To check Red Hat system reboot logs, the most commonly used commands and files are:

1. journalctl -b -1 – Shows logs from the last boot.
2. grep reboot /var/log/messages – Filters logs for reboot-related events.
3. /var/log/boot.log – Displays detailed boot-up process logs.
4. last reboot – Displays the reboot history.
5. dmesg – Shows kernel-level messages, including reboots and errors.
6. /var/log/messages – Provides general system logs, including hardware failures or reboots.

By using these methods, you can effectively track and diagnose the reasons for system reboots, whether they were manual, automatic, or due to hardware failures.