Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Can anybody explain me what is the meaning of the last column of the output of the last command? I'm particularly interested in its meaning with respect to the reboot pseudo-user.

reboot   system boot  2.6.32-28-generi Sat Feb 12 08:31 - 18:09 (9+09:37)   

What does that 9+09:37 mean?

share|improve this question
    
Can you add line of your last output? It varies between systems. –  Olli Feb 21 '11 at 11:21
    
@Olli Sorry, I don't have access to that system right now, but it is a time between parentheses. It isn't described in the man page. –  Andrea Spadaccini Feb 21 '11 at 14:58
    
@Andrea: I misunderstood your question, but I edited my answer to reflect what you asked (at least what I understood you asked). –  Olli Feb 21 '11 at 16:13
1  
@Olli thanks for the edit! You nailed it. :) –  Andrea Spadaccini Feb 21 '11 at 16:21
    
@Andrea: if my answer is answering to that question, you should accept it. –  Olli Feb 21 '11 at 16:22
show 1 more comment

1 Answer 1

up vote 6 down vote accepted

reboot and shutdown are pseudo-users for system reboot and shutdown, respectively. That's mechanism for logging that information, with kernel versions to same place, without creating any special formats to wtmp binary file.

Quote from man wtmp:

The wtmp file records all logins and logouts. Its format is exactly like utmp except that a null username indicates a logout on the associated terminal. Furthermore, the terminal name ~ with username shutdown or reboot indicates a system shutdown or reboot and the pair of terminal names |/} logs the old/new system time when date(1) changes it.

wtmp binary file do not save other than timestamp for events. For example last calculates additional things, such as login times.

reboot   system boot  2.6.32-28-generi Mon Feb 21 17:02 - 18:09  (01:07)    
...
user     pts/0        :0.0             Sat Feb 12 18:52 - 18:52  (00:00)    
user     tty7         :0               Sat Feb 12 18:52 - 20:53  (02:01)    
reboot   system boot  2.6.32-28-generi Sat Feb 12 08:31 - 18:09 (9+09:37)   

Last column (in parenthesis) is length of event. For user reboot it's uptime.

After latest reboot, time is current uptime. For earlier reboots, time is uptime after that reboot (so in last line of my example it's uptime until first line; there was no reboots in between). Number(s) before + means number of days. In last line it's 9 days, 9 hours and 37 minutes, and in first line current uptime is 1 hour and 7 minutes.

Note however that this time is not always accurate, for example after system crash and unusual restart sequence. last calculates it as time between it and next reboot/shutdown.

share|improve this answer
    
I'm curious that last | grep -i shutdown doesn't return anything. –  phunehehe Feb 21 '11 at 13:12
    
Thanks, the post is insightful and answers the question. –  Andrea Spadaccini Feb 21 '11 at 16:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.