I'm checking a server's reboot history by last -x reboot, the output is as following:

reboot   system boot  4.20.6-200.fc29. Tue Sep 24 00:21   still running
reboot   system boot  4.20.6-200.fc29. Fri Sep 20 07:48   still running
reboot   system boot  4.20.6-200.fc29. Fri Sep 20 01:11 - 23:55  (-1:15)
reboot   system boot  4.20.6-200.fc29. Thu Sep 19 23:28 - 17:17  (-6:10)
reboot   system boot  4.20.6-200.fc29. Wed Sep 18 20:12 - 15:34  (19:21)

Why there are two still running instances? According to my understanding, there should one and only one still running instance.

1 Answer 1


last reads the file /var/log/wtmp. Normally when shutting down a system a record will be written to this file indicating this fact; the same happens when booting a system to record the boot moment.

In your case apparently the shutdown record wasn't written to the file the last time, so last can't find the shutdown record matching the booting record, and writes "still running" as that is usually the case in such a situation.

I have seen the Debian version of the last command show "crash" in such situation, perhaps that the Fedora version thinks that's too alarming as there could possibly be other reasons for the missing record.

  • Thanks, it makes sense to me. But why record wasn't written to the file? Can I just empty the log file to make last statement works as before?
    – Eugene
    Sep 26, 2019 at 6:21
  • The wtmp file is usually rotated every month, so the discrepancy will resolve itself in a few days.
    – wurtel
    Sep 26, 2019 at 6:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .