When Did my Linux Box Last Reboot/ Shutdown?

The Linux command last can tell you when your Linux system last rebooted, shutdown, who logged in and any runlevel changes.

The utility parses the Linux log file  /var/log/wtmp which contains time stamped entries of these important system events.

The last command is usually installed on most Linux distributions by default and is usually ran as the root user.

Running last on it’s own will display system reboots and user logins with information such as dates, usernames and IP addresses.

last
root     pts/0        10.27.2.100      Thu May 28 00:29   still logged in
root     pts/1        10.27.2.100      Thu May 21 19:55 - 12:02 (5+16:06)
root     pts/0        10.27.2.100      Wed May 20 23:01 - 12:02 (6+13:00)
reboot   system boot  3.18.13+         Wed May 20 23:00 - 00:29 (7+01:29)
root     pts/2        10.27.2.100      Wed May 20 22:43 - down   (00:16)
root     pts/1        10.27.2.100      Wed May 20 16:40 - 16:40  (00:00)
root     pts/0        10.27.2.100      Mon May 18 09:07 - down  (2+13:53)

You can see in the above output that the operating system was last rebooted on the 20th of  May.

There are various switches you can apply to the last command to modify the output. The most common is-x to include runlevel changes and shutdown events in the output.

last -x
root     pts/0        10.27.2.100      Thu May 28 00:29   still logged in
root     pts/1        10.27.2.100      Thu May 21 19:55 - 12:02 (5+16:06)
root     pts/0        10.27.2.100      Wed May 20 23:01 - 12:02 (6+13:00)
runlevel (to lvl 2)   3.18.13+         Wed May 20 23:00 - 00:31 (7+01:30)
reboot   system boot  3.18.13+         Wed May 20 23:00 - 00:31 (7+01:30)
shutdown system down  3.18.7+          Wed May 20 23:00 - 23:00  (00:00)
runlevel (to lvl 6)   3.18.7+          Wed May 20 23:00 - 23:00  (00:00)
root     pts/2        10.27.2.100      Wed May 20 22:43 - down   (00:16)
root     pts/1        10.27.2.100      Wed May 20 16:40 - 16:40  (00:00)
root     pts/0        10.27.2.100      Mon May 18 09:07 - down  (2+13:53)

You can also use last to analyse a log file out of position, such as a logfile you’ve archived. Use the -f switch along with the log file path and name to read it’s data.

last -f /mnt/archive/webserver/wtmp
root     pts/0        10.27.2.100      Thu May 28 00:29   still logged in
root     pts/1        10.27.2.100      Thu May 21 19:55 - 12:02 (5+16:06)
root     pts/0        10.27.2.100      Wed May 20 23:01 - 12:02 (6+13:00)
reboot   system boot  3.18.13+         Wed May 20 23:00 - 00:35 (7+01:34)
root     pts/2        10.27.2.100      Wed May 20 22:43 - down   (00:16)
root     pts/1        10.27.2.100      Wed May 20 16:40 - 16:40  (00:00)
root     pts/0        10.27.2.100      Mon May 18 09:07 - down  (2+13:53)