Finding time of last shutdown

Crowe · Oct 29, 2009

Hello All,

I have a unique situation. My wife and I moved to Japan about 5 months ago and we came home two nights ago to find our house unlocked, power out, and our belongings scattered around. The rear window was broken and some things were stolen. Luckily, the iMac was left upstairs.

I'm trying my hardest to find a time for the power outage in the console logs, but I'm having no luck. I figured the time of the shutdown would give me some idea of when the thieves broke in.

Thanks,

McBie · Oct 29, 2009

I guess you are not going to find a timestamp in the logs because your Mac was not properly shutdown, so it did not have time to write anything to the logs.

Unless your Mac was running on a UPS, in which case the UPS might have written something to its internal log. ( That would depend on the brand/model of the UPS )

Don't forget to check the internal log of the modem/router .... there might be an indication in there.

Not much of a help .... I know ..... sorry

Cheers ... McBie

deus_ex_machina · Oct 29, 2009

You could see the last time ANYTHING was written to the system log before you turned the computer back on that night/day.

Dysfunction · Oct 29, 2009

Ok, you can grep for either bootlog or shutdown in /var/log/system.log

like such

Code:

mikeMbp:log mike$ grep bootlog /var/log/system.log
Oct 24 11:51:34 mikeMbp bootlog[45]: BOOT_TIME: 1256410271 0
Oct 26 16:28:03 mikeMbp bootlog[45]: BOOT_TIME: 1256599660 0
Oct 26 16:31:25 mikeMbp bootlog[42]: BOOT_TIME: 1256599861 0
Oct 28 15:38:09 localhost bootlog[43]: BOOT_TIME: 1256769467 0
Oct 28 15:41:20 localhost bootlog[43]: BOOT_TIME: 1256769659 0
mikeMbp:log mike$ grep shutdown /var/log/system.log
Oct 24 11:46:48 mikeMbp shutdown[3081]: reboot by mike: 
Oct 24 11:46:48 mikeMbp shutdown[3081]: SHUTDOWN_TIME: 1256410008 279014
Oct 26 16:27:04 mikeMbp shutdown[4046]: reboot by mike: 
Oct 26 16:27:04 mikeMbp shutdown[4046]: SHUTDOWN_TIME: 1256599624 869928
Oct 26 16:30:44 mikeMbp shutdown[215]: reboot by mike: 
Oct 26 16:30:44 mikeMbp shutdown[215]: SHUTDOWN_TIME: 1256599844 585882
Oct 28 15:39:47 mikeMbp sudo[200]: mike : TTY=ttys000 ; PWD=/Users/mike ; USER=root ; COMMAND=/sbin/shutdown -h now
Oct 28 15:39:47 mikeMbp shutdown[200]: halt by mike: 
Oct 28 15:39:47 mikeMbp shutdown[200]: SHUTDOWN_TIME: 1256769587 961920

I'm not sure though what a non-graceful shutdown would look like

rman · Oct 29, 2009

or from a terminal window, do a last and look that listing

Dysfunction · Oct 29, 2009

argghhh, forgot about last

Crowe · Oct 30, 2009

Thanks everyone. My terminal skills are beyond newb. Could you help me find the "last" readings?

deus_ex_machina · Oct 30, 2009

this command's not complicated: open Terminal, type "last"