When Did my Linux Box Last Reboot/ Shutdown?
Category : How-to
The Linux command last can tell you when your Linux system last rebooted, shutdown, who logged in and any runlevel changes.
The utility parses the Linux log file /var/log/wtmp which contains time stamped entries of these important system events.
The last command is usually installed on most Linux distributions by default and is usually ran as the root user.
Running last on it’s own will display system reboots and user logins with information such as dates, usernames and IP addresses.
last root pts/0 10.27.2.100 Thu May 28 00:29 still logged in root pts/1 10.27.2.100 Thu May 21 19:55 - 12:02 (5+16:06) root pts/0 10.27.2.100 Wed May 20 23:01 - 12:02 (6+13:00) reboot system boot 3.18.13+ Wed May 20 23:00 - 00:29 (7+01:29) root pts/2 10.27.2.100 Wed May 20 22:43 - down (00:16) root pts/1 10.27.2.100 Wed May 20 16:40 - 16:40 (00:00) root pts/0 10.27.2.100 Mon May 18 09:07 - down (2+13:53)
You can see in the above output that the operating system was last rebooted on the 20th of May.
There are various switches you can apply to the last command to modify the output. The most common is-x to include runlevel changes and shutdown events in the output.
last -x root pts/0 10.27.2.100 Thu May 28 00:29 still logged in root pts/1 10.27.2.100 Thu May 21 19:55 - 12:02 (5+16:06) root pts/0 10.27.2.100 Wed May 20 23:01 - 12:02 (6+13:00) runlevel (to lvl 2) 3.18.13+ Wed May 20 23:00 - 00:31 (7+01:30) reboot system boot 3.18.13+ Wed May 20 23:00 - 00:31 (7+01:30) shutdown system down 3.18.7+ Wed May 20 23:00 - 23:00 (00:00) runlevel (to lvl 6) 3.18.7+ Wed May 20 23:00 - 23:00 (00:00) root pts/2 10.27.2.100 Wed May 20 22:43 - down (00:16) root pts/1 10.27.2.100 Wed May 20 16:40 - 16:40 (00:00) root pts/0 10.27.2.100 Mon May 18 09:07 - down (2+13:53)
You can also use last to analyse a log file out of position, such as a logfile you’ve archived. Use the -f switch along with the log file path and name to read it’s data.
last -f /mnt/archive/webserver/wtmp root pts/0 10.27.2.100 Thu May 28 00:29 still logged in root pts/1 10.27.2.100 Thu May 21 19:55 - 12:02 (5+16:06) root pts/0 10.27.2.100 Wed May 20 23:01 - 12:02 (6+13:00) reboot system boot 3.18.13+ Wed May 20 23:00 - 00:35 (7+01:34) root pts/2 10.27.2.100 Wed May 20 22:43 - down (00:16) root pts/1 10.27.2.100 Wed May 20 16:40 - 16:40 (00:00) root pts/0 10.27.2.100 Mon May 18 09:07 - down (2+13:53)