Linux Commands / IT Support Guides
Investigate the previous Linux boot with journalctl
After an unexpected restart, the current boot may no longer show the failure. Check available boot records before assuming historical evidence exists.
Environment and inputs: Linux · Bash-compatible shell; package and service names vary by distribution
Try the diagnostic command
Use the stated shell and platform. Replace sample domains, addresses, services and paths with values from the system you are authorized to support.
journalctl --list-boots
journalctl -b -1 -p warning --no-pagerHow to read the result
The boot list identifies retained boot sessions. The second command requests warning-and-higher messages from the previous boot; it works only if those records were retained.
What to do next
Compare the last recorded events with infrastructure restart records and the host's power or hypervisor history. Absence of a clean shutdown message is a clue rather than a complete diagnosis.
Before you make a change
Volatile journaling can lose records at reboot. Do not claim a cause solely from the last visible warning before a gap.