I have my ubuntu machine which is running Ubuntu 10.10 and that machine is running my app server.

I am suspecting that my machine got restarted today at some time but I don't know how to find out at what time my machine got restarted today? And if it got restarted then who restarted it and why it got restarted up. Is there any way I can find out these details?

I tried using uptime and this is what I got which means my machine is up since 20 hours and 21 minutes (am I right?)

david@machineA:~$ uptime
 22:55:37 up 20:21,  3 users,  load average: 0.01, 0.05, 0.01

Can anyone provide me some steps how can I find out these details?

  • Ubuntu 10.10 is EOL! – Pandya Nov 6 '14 at 6:10
  • Yup, very well aware of that :) It's my bad luck that I got these VM's in our company which is running Ubuntu 10.10. – arsenal Nov 6 '14 at 6:11
  • Yeah it was restarted, and has been up for 20:21 hours:minutes. – slm Nov 6 '14 at 6:12

The first field of /proc/uptime is your friend for when (go read it with cat /proc/uptime). It's a running count of seconds that your system has been up. The second field of that file is how many cpuseconds have been idle on your system (divide it by the number of CPUs listed in /proc/cpuinfo in that system to get actual seconds).

# if your awk is new enough, 1 second resolution.
awk '//{print strftime("%c",systime()-$1)}' /proc/uptime 
# for older awk, but requires bc binary, high resolution
date -d @$(echo $(date +%s.%N) - $(awk '{print $1}' /proc/uptime) |bc )
# older awk, 1 second resolution, no bc
date -d @$(( $(date +%s) - $(awk '{printf "%d",$1}' /proc/uptime) ))

Will print the boot time of your system, within 1 second. I say within 1 second, because the is fractional, and awk only returns systime as an integer.

This does not tell you who or why it was restarted. The best you can do for that is the output of the last command, which will record normal shutdowns and reboots; as well as sessions lost as a result of a hard reboot (eg power blip, kernel bug). These aren't reliable, as they depend on nobody tampering with the /var/log/wtmp* files.

Here's an example of a lost session:

root@nms1:~# last -f /var/log/wtmp.1
root     pts/0        10.x.y.z      Mon Oct 27 05:41    gone - no logout 
root     pts/0        10.x.y.z      Mon Oct 20 04:55 - 16:47  (11:51)    

And here's an example of a reboot.

[root@freepbx ~]# last
reboot   system boot  2.6.32-431.el6.x Mon Oct 20 13:46 - 16:13 (3+02:27)   
root     pts/2        10.x.y.z      Wed Oct 15 21:02 - 00:51 (2+03:48)   
root     pts/1        10.x.y.z      Wed Oct 15 14:17 - 00:51 (2+10:33)   
sitkasta pts/0        10.x.y.z      Tue Oct 14 20:23 - down  (5+17:22)   
root     pts/0        10.x.y.z      Tue Oct 14 10:43 - 20:22  (09:39)    

If you want anything more, look at something like the audit framework, and send reboot/shutdown commands to a reliable & secure remote logging destination.

  • when you say first field of /proc/uptime you mean to say 20:21 in my case? I tried running this awk '//{print strftime("%c",systime()-$1)}' /proc/uptime but I got an error as awk: line 2: function strftime never defined awk: line 2: function systime never defined – arsenal Nov 6 '14 at 6:21
  • The awk in Ubuntu 10.10 is too old, and doesn't have those functions; I'll revise above. – robbat2 Nov 6 '14 at 6:30
  • Thanks robbat for the help. After I ran last command as you told me, I got one line which shows this reboot system boot 2.6.35-22-server Wed Nov 5 02:34 - 23:19 (20:45) what does this mean? I was not able to understand this line 02:34 - 23:19 specifically? – arsenal Nov 6 '14 at 6:32
  • 02:34 - 23:19 means that the system booted at 02:34 and shut down at 23:19, a total of 20h45min (in my example above, it was 3 days 2 hours, 27 minutes. – robbat2 Nov 6 '14 at 6:36
  • meaning system rebooted at 02:34 AM in the morning today? And what does shut down mean then in this context? Isn't they should be same? – arsenal Nov 6 '14 at 6:37

Use the command below to find the machine down time.


The time which is not show shown in the list is the reboot time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.