How to find who rebooted the Linux server ??

How to find who rebooted the Linux server ??

The below steps will help to find out who or when the server had rebooted last time. Once the server had panic reboot or some one rebooted system admin need to find out why/ who and when the server had rebooted.
Hope the below will help to find out the things.

1. last command

#last reboot


#last |grep -i reboot

2. who –b

This command displays the time of last system boot and who logged on.

3.See these users shell history files in ~username/.bash_history for su or sudo commands.


# cat /var/log/boot.log


#more /var/log/messages 

  - and check the syslog started" time stamp

6. grep reboot /home/*/.bash_history

  >> Now you can get which user rebooted the server.

Post a Comment


  1. Good One..


  2. I was also searching for this problem when i was using the linux but havn't found any possible solution but you content helps me a lot about my issue.

  3. Our brand is one of the best online polo t shirts pakistan at a cheap rate.

  4. I was looking for this problem since very long but currently busy commercial law dissertation topics after this I will again look into this matter.

  5. To determine who rebooted the Linux server, you can check the system logs using the command "last reboot" or review the "/var/log/wtmp" file for the most recent login entries.