Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Last shows "crash" at 12:02 and 14:18, but the system didn't stop working at that time. The reboot at 15:03, on the other hand, was to recover from an actual crash - our system stopped responding at 14:46. Why does last show two "crashes" prior to the actual crash of the machine?

[admin@devbox log]$ last | head
myuser pts/2        myhostname  Wed Sep 28 15:12   still logged in
myuser pts/2        myhostname  Wed Sep 28 15:09 - 15:12  (00:02)
myuser pts/2        myhostname  Wed Sep 28 15:07 - 15:09  (00:01)
myuser pts/1        myhostname  Wed Sep 28 15:06   still logged in
myuser pts/0        myhostname  Wed Sep 28 15:04   still logged in
reboot   system boot  2.6.18-274.el5PA Wed Sep 28 15:03          (00:09)
myuser pts/1        myhostname  Wed Sep 28 14:18 - crash  (00:44)
myuser pts/0        myhostname  Wed Sep 28 12:02 - crash  (03:01)

EDIT: The reboot at 15:03 is real enough - but the two "crash" entries at 14:18 and 12:02 I can't explain.

share|improve this question
40 minutes ... but that's since the reboot. – Kyle Hodgson Sep 28 '11 at 19:44
Ah, sorry. Didn't understand your question. When you said "but the system didn't reboot", I thought you were saying that no reboot happened at all. – Mat Sep 28 '11 at 19:52
up vote 9 down vote accepted

last prints crash as logout time when there is no logout entry in the wtmp database for an user session.

The last entry in last output means that myuser logged on pts/0 at 12:02 and, when system crashed between 14:18 and 15:03, it should be still logged in.

Usually, in wtmp there are two entries for each user session. One for the login time and one for the logout time. When a system crashes, the second entry could be missing. So last supposes that the user was still logged on when the system crashed and prints crash as logout time.

To be more clear, that two "crash" line are only the two session that were active when the system crashed around 15:00, not two system crash.

share|improve this answer
Don't I feel rusty now... sure I knew this at some point! Thanks... – Kyle Hodgson Sep 28 '11 at 21:47
Does last always print a reboot record after a crash? And is it possible for the user session to crash but the entire OS? – CMCDragonkai Dec 8 '15 at 11:38
1) Yes, it is. wtmp will record each system boot but the message displayed (by last) is implementation dependent. 2) No, user session cannot crash. A program managing a user session can abnormally end but, in this case, wtmp will simply record a logout. – andcoz Dec 8 '15 at 18:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.