Você pode usar o comando last
para dar uma olhada no log que lida com o desligamento e reinicializações.
Experimente o comando
last -xwF
para o qual você obteria algo assim (esta é minha saída)
manish pts/2 :0 Thu Apr 5 19:09:33 2012 still logged in
runlevel (to lvl 2) 3.2.0-21-generic Thu Apr 5 17:46:34 2012 - Thu Apr 5 21:25:50 2012 (03:39)
reboot system boot 3.2.0-21-generic Thu Apr 5 17:46:34 2012 - Thu Apr 5 21:25:50 2012 (03:39)
manish pts/2 :0.0 Thu Apr 5 02:12:38 2012 - Thu Apr 5 02:12:47 2012 (00:00)
manish pts/1 :0 Thu Apr 5 00:31:27 2012 - crash (17:15)
runlevel (to lvl 2) 3.2.0-21-generic Wed Apr 4 18:42:38 2012 - Thu Apr 5 17:46:34 2012 (23:03)
reboot system boot 3.2.0-21-generic Wed Apr 4 18:42:38 2012 - Thu Apr 5 21:25:50 2012 (1+02:43)
manish pts/5 :0 Wed Apr 4 00:31:25 2012 - crash (18:11)
manish pts/3 :0 Wed Apr 4 00:19:11 2012 - crash (18:23)
manish pts/2 :0 Wed Apr 4 00:18:15 2012 - crash (18:24)
runlevel (to lvl 2) 3.2.0-21-generic Tue Apr 3 19:29:27 2012 - Wed Apr 4 18:42:38 2012 (23:13)
reboot system boot 3.2.0-21-generic Tue Apr 3 19:29:27 2012 - Thu Apr 5 21:25:50 2012 (2+01:56)
manish pts/4 :0.0 Tue Apr 3 01:37:45 2012 - Tue Apr 3 01:57:44 2012 (00:19)
manish pts/3 :0 Mon Apr 2 23:39:22 2012 - crash (19:50)
manish pts/1 :0 Mon Apr 2 23:05:03 2012 - crash (20:24)
runlevel (to lvl 2) 3.2.0-21-generic Mon Apr 2 19:03:57 2012 - Tue Apr 3 19:29:27 2012 (1+00:25)
reboot system boot 3.2.0-21-generic Mon Apr 2 19:03:57 2012 - Thu Apr 5 21:25:50 2012 (3+02:21)
shutdown system down 3.2.0-17-generic Mon Apr 2 08:54:27 2012 - Mon Apr 2 19:03:57 2012 (10:09)
shutdown system down 3.2.0-17-generic Mon Apr 2 08:54:22 2012 - Mon Apr 2 08:54:27 2012 (00:00)
runlevel (to lvl 0) 3.2.0-17-generic Mon Apr 2 08:53:40 2012 - Mon Apr 2 08:54:22 2012 (00:00)
manish pts/7 :0.0 Sun Apr 1 20:53:34 2012 - Mon Apr 2 02:28:21 2012 (05:34)
manish pts/5 :0 Sun Apr 1 16:00:45 2012 - Mon Apr 2 08:53:12 2012 (16:52)
Você pode percorrer as entradas
last -xwF | grep reboot
last -xwF | grep shutdown