I have the following lines extracted from the output of last. It shows two reboots, and that userA was logged in right up to the reboot. So far, I am able to interpret the data.

However, what I do not understand right now, is the login-time of the pseudo user reboot. For any ordinary users, the two times are the time the user logged-in and logged-out. In case, of a reboot, the entry for the log-out time is crash, indicating, that the user was logged-in right until the bitter end. No statement, whether the user is a victim or the culprit.

My guess is, that the log-in time of the pseudo user reboot is the time when the system reboot was initiated. However, what determines the log-out time of the user reboot?

reboot   system boot  3.10.0-327.13.1. Mon Nov 28 08:08 - 10:35  (02:26)    
userA    pts/0        10.ZZ.YY.XX      Sun Nov 27 08:01 - crash (1+00:06)   
reboot   system boot  3.10.0-327.13.1. Sun Nov 27 07:36 - 10:35 (1+02:58)   
userA    pts/9        10.ZZ.YY.XX      Fri Nov 25 17:39 - crash (1+13:57)   
userA    pts/0        10.ZZ.YY.XX      Fri Nov 25 16:17 - crash (1+15:18)  

Its refer to the time between reboots. i will explain with example:

root     pts/0    Mon Nov 28 10:53   still logged in   
reboot   system boot  2.6.32-642.11.1. Mon Nov 28 10:14 - 11:00  (00:45)    
root     pts/0    Mon Nov 28 10:11 - down   (00:02)    
reboot   system boot  2.6.32-642.11.1. Mon Nov 28 10:09 - 10:14  (00:04)    
root     pts/0    Mon Nov 28 10:08 - down   (00:01)    
reboot   system boot  2.6.32-642.11.1. Mon Nov 28 10:07 - 10:09  (00:01)    
root     pts/0    Mon Nov 28 10:06 - down   (00:01)    
reboot   system boot  2.6.32-642.11.1. Mon Nov 28 10:05 - 10:07  (00:01)    
root     pts/0    Mon Nov 28 09:23 - down   (00:41)    
reboot   system boot  2.6.32-642.11.1. Mon Nov 28 09:21 - 10:05  (00:43)    
root     pts/0    Mon Nov 28 04:42 - down   (04:39)

the last reboot logout time will keep change every minute and you can notice that if you type last any time you will see that the last reboot has the present time and the reboots before it every each one of them refer to the time that next reboot happen


There is no user account named reboot. From man last:

The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all the reboots since the log file was created.

  • I know, my question was not on why there is a user listed named reboot, but how the log-out time of reboot is determined. – Dohn Joe Nov 28 '16 at 12:52
  • @DohnJoe - in the case of the crash entry, it seems that's listed when, for whatever reason, a second logout time is not recorded in wtmp. Seems like it could be because of a system crash, or anything else that might cause wtmp to not get written to. See: unix.stackexchange.com/a/21661/12916 – jefflunt Nov 15 '18 at 1:41
  • @DohnJoe - in normal logout situations, the logout time is the current hh:mm of the logout, then the delta (days+hh:mm) is shown on the far right. I know this question/answer is old, but I hope this helps - I was just wondering the same thing. – jefflunt Nov 15 '18 at 1:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.