How to shut down your Linux system using the command line

What is the shutdown command in Linux?

A shutdown is the process of turning your workstation or server off. Linux provides various options to shut down your system, including an immediate turn off, scheduled shutdowns, and reboots. When a shutdown is initiated, no users are allowed to log in, and the active users are notified of the shutdown.

To reboot or shut down a system in a Linux environment, the systemctl command must be used. However, the command can only be executed by a root user. If the user doesn't have such privileges, adding sudo in front of the command lets you carry out the command temporarily.

This article describes the different ways to shut down a Linux system.

Syntax of the shutdown command in Linux

One of the commonly used commands to shut down a Linux system is the shutdown command. Note that only root users can execute this command to shut down the system. Alternatively, you can temporarily gain root privileges to execute the shutdown command. Let's cover the basic syntax of the shutdown command before exploring the various options that's available to shut down your Linux system.

To use the shutdown command, type:

• Options: This specifies the action to be taken (e.g., halt, reboot).
• Time: Defines when the specified action should occur.
• Message: A custom message to display to actively logged in users before the shutdown.

Common options used in conjunction with the shutdown command

The shutdown command in Linux is versatile, allowing for various operations related to shutting down the system. Let's check out some of the common options you can use with this command:

• -h or --halt: Halts the system by stopping all the CPU functions immediately.
• -r or --reboot: Reboots the system after shutting down.
• -c or --cancel: Cancels a scheduled shutdown or reboot.
• -k or --kmsg: Sends a warning message to all logged-in users without actually shutting down.
• -n or --no-wait: Instructs the system to shut down without waiting for processes to terminate gracefully.
• -t or --time: Specifies the time at which the system should be shut down.

What is the systemctl command in Linux?

The systemctl command is an essential tool for Linux administrators, providing comprehensive control over services and the overall system state. It simplifies the interaction with systemd, allowing you to manage services, system states, and configurations using a consistent command set.

This command also provides a straightforward way to check the status of services, offering insights into their operational states, such as active, inactive, failed, or disabled. It's important to gain mastery over this command, which enhances the ability to manage Linux environments effectively.

How to use the shutdown command

Below are some of the commands used to shut down systems in Linux:

Here's a complete breakdown of the different commands used to shut down your Linux system:

1) Shutting the system down immediately

The command "sudo shutdown -h now" initiates an immediate system shutdown on a Linux system.

2) Restarting the system on Linux

The command "sudo shutdown -r now" is used to initiate a system shutdown and restart immediately on Linux.

3) Scheduling a shutdown on Linux

You might need to reboot machines at odd hours. Being able to instruct the machine to shut down on its own will save you the trouble of manually doing so.

There are two ways to go about scheduling a shutdown on Linux systems. You can either specify the exact time at which the system needs to be shut down, or shut down the system in "n" minutes from a particular time.

The above command will schedule a shutdown in 10 minutes from the moment the command is executed.

In this command, the timestamp "09:00" indicates the specific time at which the system should be shut down.

4) Force shutting and force starting the system on Linux

You'll inevitably have situations where the systems will act up and refuse to shut down. In such cases, you can execute the following command to enable a force shutdown of your system.

or

If this does not work, you can use the command with the --force option twice.

The above command is akin to unplugging the machine and should only be used as a last resort, as it bypasses standard shutdown procedures.

5) Broadcasting a custom message at the time of shutdown

This option allows you to send out a message to all system users notifying them of when the shutdown will take place. This gives everyone the chance to save their work and log off safely before the system shuts down.

6) Canceling a scheduled shutdown

By executing this command, you can cancel a previously scheduled shutdown.

Abnormal system shutdowns and reboots

Unexpected shutdowns and reboots are the last thing you want as an administrator. If a critical system experiences this, any unsaved data in the applications will be lost. This includes documents and files that were open at the time of a shutdown.

You can check the shutdown history of a system using the following command:

This command used to display a list of the most recent login sessions and system shutdowns, providing a summary of user activity and system events.

• last: This command retrieves the login history of users on the system by reading from the /var/log/wtmp file. It shows information such as usernames, terminal names, login times, and durations of sessions.
• -x: This option extends the output to include system shutdowns and run level changes, allowing you to see when the system was shut down or rebooted alongside user logins.
• | more: Sends the output of the last -x command to more, which allows you to view the output one screen at a time. This is particularly useful for long outputs that exceed the terminal's display capacity.

The entries in the output show two timestamps, where the first timestamp is for system shutdown and the second is for system startup.

Here's what each entry in the command represents:

• User logins show the username, terminal, login time, and duration.
• Run level changes indicate transitions between different operational states of the system.
• Reboot events detail when the system was restarted.
• Shutdown events specify when the system was powered down, including start and end times along with duration.

This command allows you to monitor user activities, system uptime, and identify when shutdowns occur. However, this command doesn't centralize the Linux system events across your network. A comprehensive log management solution that can monitor the system activities continuously can help you with the overall Linux system stability in your environment.

How ManageEngine EventLog Analyzer helps monitor Linux shutdowns and investigate unexpected shutdowns

EventLog Analyzer, a comprehensive log management solution, collects, monitors, correlates, and archives logs centrally from your network, including Linux environments. It's a one-stop shop for you to troubleshoot errors, fortify your security posture, and help you stay compliant with regulatory mandates.

EventLog Analyzer's built-in syslog server collects syslogs from Linux systems and analyzes them in real-time. It tracks all Linux system events including shutdowns, user activity, m ail server events , logons, logoffs, sudo command executions, system events, and more.

Key metrics to be tracked from Linux shutdown events using EventLog Analyzer

Monitoring Linux shutdown events is crucial for identifying issues for unexpected shutdowns, slow shutdown processes, unauthorized shutdowns, service disruptions, and planning for performance maintenance. Often, compliance mandates also require you to centralize and monitor the system events of critical infrastructure that holds personal information. Therefore, it's essential for you to continuously monitor shutdown events of critical Linux servers that hold sensitive data in your network. EventLog Analyzer, helps you track:

• Shutdown frequency: Lists the total number of shutdowns that happened on all critical Linux servers in your environment.
• Shutdown reasons: Provides you with the reasons for shutdowns, such as hardware failures, software errors, or user-initiated actions based on syslog analysis.
• Shutdown impacts: Helps identify services or applications affected by shutdowns.
• System load before shutdown: Tracks free space on the file systems that comprise transaction log and database directories to detect potential overloads or resource exhaustion leading to shutdowns.



• Analyzing Linux logs: Further, this Linux log monitoring tool also correlates the system event with other network logs to identify the relationship between shutdowns and system errors, performance issues, or security incidents.

What's next?