Where do I find the Shutdown Log files? Odd things showing up in the shutdown scripting lines lately

When shutting down, the lines scrolling up the screen(too fast for me to capture) indicate there is something ‘Stopping some mail’ thing and other stuff.
I can find login in logs, but I can find any except be name for shutdown.
I would like to read one of the later ones that include those long sets of ‘Stopping ???’ whatever.
The ‘Stopping’ things weren’t there until after one of the latest sets of updates(not the kernel update).

localhost:~> last -x shutdown
shutdown system down  4.12.14-lp150.12 Sun Oct 28 18:22 - 18:23  (00:01)
shutdown system down  4.12.14-lp150.12 Sat Oct 27 19:43 - 16:15  (20:31)
shutdown system down  4.12.14-lp150.12 Fri Oct 26 18:31 - 17:00  (22:28)
shutdown system down  4.12.14-lp150.12 Thu Oct 25 18:51 - 16:50  (21:58)
shutdown system down  4.12.14-lp150.12 Thu Oct 25 18:46 - 18:47  (00:01)
shutdown system down  4.12.14-lp150.12 Thu Oct 25 18:41 - 18:42  (00:01)
shutdown system down  4.12.14-lp150.12 Tue Oct 23 18:42 - 16:14 (1+21:31)
shutdown system down  4.12.14-lp150.12 Mon Oct 22 19:39 - 17:23  (21:43)
shutdown system down  4.12.14-lp150.12 Sat Oct 20 19:14 - 16:36 (1+21:21)
shutdown system down  4.12.14-lp150.12 Fri Oct 19 20:17 - 15:05  (18:47)
shutdown system down  4.12.14-lp150.12 Fri Oct 19 17:25 - 17:26  (00:01)

wtmp begins Fri Oct 19 17:10:51 2018

A guide on examining the systemd journal log…

You can filter by time eg

journalctl --since "2018-10-29 15::08:00"

*This might be useful if you know you shutdown the system at a given time

Examine the last 250 lines from the previous boot

sudo journalctl -b -1 -n 250

Capture the output to a text file for further viewing…

sudo journalctl -b -1 -n 250 > output.log

You may try:

erlangen:~ # **journalctl --output short-full --boot -1 -u systemd-reboot.service **
-- Logs begin at Sun 2018-08-26 08:48:18 CEST, end at Tue 2018-10-30 10:47:30 CET. --
Sat **2018-10-27 12:25:48** CEST erlangen systemd[1]: Starting Reboot...
erlangen:~ # **journalctl --output short-full --boot -1 --since '2018-10-27 12:25:48'**
-- Logs begin at Sun 2018-08-26 08:48:18 CEST, end at Tue 2018-10-30 10:47:30 CET. --
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Unmounted /home.
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Reached target Unmount All Filesystems.
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Stopped target Local File Systems (Pre).
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Stopped Create Static Device Nodes in /dev.
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Stopped Remount Root and Kernel File Systems.
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Reached target Shutdown.
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Reached target Final Step.
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Starting Reboot...
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Shutting down.
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Hardware watchdog 'iTCO_wdt', version 0
Sat 2018-10-27 12:25:48 CEST erlangen systemd[1]: Set hardware watchdog to 10min.
Sat 2018-10-27 12:25:48 CEST erlangen kernel: watchdog: watchdog0: watchdog did not stop!
Sat 2018-10-27 12:25:48 CEST erlangen kernel: systemd-shutdow: 28 output lines suppressed due to ratelimiting
Sat 2018-10-27 12:25:48 CEST erlangen systemd-shutdown[1]: Syncing filesystems and block devices.
Sat 2018-10-27 12:25:48 CEST erlangen systemd-shutdown[1]: Sending SIGTERM to remaining processes...
Sat 2018-10-27 12:25:48 CEST erlangen haveged[512]: haveged: Stopping due to signal 15
Sat 2018-10-27 12:25:48 CEST erlangen haveged[512]: haveged starting up
Sat 2018-10-27 12:25:48 CEST erlangen systemd-journald[419]: Journal stopped
erlangen:~ # 

Thanks, I will give these a try. Those multiple big bold green STOPPING… messages that take up about 20 full screen lines during shutdown are bothering me.
Can’t capture, but would like to!

Yes, you can - redirect the outptut to a text file (as per my example in my last post).

So run your command and capture output to a text file like this…

journalctl --output short-full --boot -1 --since '2018-10-27 12:25:48' > output.txt