I have the following lines extracted from the output of
last. It shows two reboots, and that
userA was logged in right up to the reboot. So far, I am able to interpret the data.
However, what I do not understand right now, is the login-time of the pseudo user
reboot. For any ordinary users, the two times are the time the user logged-in and logged-out. In case, of a reboot, the entry for the log-out time is
crash, indicating, that the user was logged-in right until the bitter end. No statement, whether the user is a victim or the culprit.
My guess is, that the log-in time of the pseudo user
reboot is the time when the system reboot was initiated. However, what determines the log-out time of the user
reboot system boot 3.10.0-327.13.1. Mon Nov 28 08:08 - 10:35 (02:26) userA pts/0 10.ZZ.YY.XX Sun Nov 27 08:01 - crash (1+00:06) reboot system boot 3.10.0-327.13.1. Sun Nov 27 07:36 - 10:35 (1+02:58) userA pts/9 10.ZZ.YY.XX Fri Nov 25 17:39 - crash (1+13:57) userA pts/0 10.ZZ.YY.XX Fri Nov 25 16:17 - crash (1+15:18)