3

I am using the following 3 commands to check the latest time point when my computer is rebooted:

last reboot
who -b
uptime

The result for last reboot is:

wtmp begins Sat Oct  9 04:49:27 2021

The result for who -b is:

system boot  2018-01-11 20:52

The result for uptime is:

22:49:01 up 1372 days, ...

It seems that the result of uptime and who -b is consistent with each other, but inconsistent with that of last reboot.

I find this post Uptime and who -b are showing different times when the system was last booted on Linux, but it said his uptime and who -b is inconsistent with each other, different from my case.

Improve this question

1 Answer 1

Reset to default
5

On Linux, all three commands use different sources of information by default.

uptime uses the information given by the kernel in /proc/uptime. The latter contains two pieces of information: the system’s uptime, including time spent suspended, and the time spent in the idle process. These values are accurate.

who -b uses the information stored in /var/run/utmp. On current systems, this is really /run/utmp, and only has information for the current boot (/run is a tmpfs which loses its contents when the system is rebooted); but for the current boot, it is also accurate.

last reboot uses the information stored in /var/log/wtmp. The information stored there is also generally accurate, but the information you need might no longer be stored there: wtmp is rotated in many setups, typically monthly. This means that if the system’s current boot time is older than wtmp’s last rotation time, the information presented will be partial. In particular, last reboot ends up showing the last rotation time, not the system’s actual boot time. This is why last shows the time at which wtmp begins: that’s the time horizon for the information displayed by last.

When wtmp contains the last boot time, last reboot does show it:

$ last reboot | head -n 1
reboot   system boot  5.10.0-8-amd64   Mon Sep 13 15:56   still running
$ who -b
         system boot  2021-09-13 15:56
$ uptime
 09:11:03 up 31 days, 17:15, 13 users,  load average: 0.48, 0.34, 0.42
Improve this answer
3
  • Thank you very much. It seems my last reboot does not reflect the reboot time, but the rotation time.
    – alancc
    Oct 15, 2021 at 20:58
  • @alancc you can try using the old rotated files (e.g., last -f /var/log/wtmp.1) to see if earlier information is available.
    – muru
    Oct 16, 2021 at 2:09
  • @muru, that returns "no such file" which means the earlier files are not existing any more. But I find another file wtmp-20211009, after using that file, the restart time is bring to August 29.
    – alancc
    Oct 16, 2021 at 3:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .