Interpreting last reboot output
Run last reboot -F
and the output should be clearer. The -F
option means:
Print full login and logout times and dates.
So those values show the timespan between reboots.
It means that the system booted at 14:12
and was shut down at 20:09
, for a total uptime of 5:56
.
TL;DR
In the case where it is the most recent entry, as in the question with | head -1
, the shut down time is the current system time, and the uptime reflects how long the system has been running currently. All the remaining lines that are in the log, show if you don't use head
to limit the output, show the actual shut down time and uptime for the system beginning at the date and time given.
For example, on my system last reboot | head -6
gives:
reboot system boot 4.4.46-11-defaul Mon Apr 10 19:58 - 04:00 (5+08:00)
reboot system boot 4.4.46-11-defaul Sat Apr 8 17:22 - 08:19 (1+14:56)
reboot system boot 4.4.46-11-defaul Sat Apr 8 00:15 - 11:06 (10:51)
reboot system boot 4.4.46-11-defaul Thu Apr 6 18:46 - 00:04 (1+05:18)
reboot system boot 4.4.46-11-defaul Wed Apr 5 17:43 - 11:30 (17:46)
reboot system boot 4.4.46-11-defaul Tue Apr 4 21:36 - 09:36 (12:00)
That translates into the following sequence, reversing the order:
Booted Shut Down System up for
------------ ------------ -------------
Apr 4 21:36 Apr 5 09:36 12:00
Apr 5 17:43 Apr 6 11:30 17:46
Apr 6 18:46 Apr 8 00:04 1 day 05:18
Apr 8 00:15 Apr 8 11:06 10:51
Apr 8 17:22 Apr 10 08:19 1 day 14:56
Apr 10 19:58 Still running 5 days 08:00 (so far)
The first line, which is the most recent boot, will not have its shut down time finalized until the system is actually shut down. Instead, it will display the current time every time you run the last reboot
command.
So you are correct in that it's improbable that the reboot process started at 2:12pm and ended at 8:09pm. If that were true, it would be time to do some serious work on your system! How long the reboot process took is not reflected in that output, rather it is how long the system has been running since it was booted. The last
command does not give that information directly. It does, however, give entries that can help you figure out how long the process takes, roughly.
To do this you need to include the -x
option which adds the system runlevel
and shutdown
entries to the output. To filter the output look for both the reboot
pseudo-user and the runlevel
pseudo-user. To make last
add seconds to the reported times use the -F
option, which expands the time entries to full date and time, including seconds. Also, there will be two entries for each boot process rather than one, so you need to double the number passed to the head
command; if I want the last 6 reboots, as above, I'll need to use -12
this time.
Executing last -xF reboot runlevel | head -12
gives:
runlevel (to lvl 5) 4.4.46-11-defaul Mon Apr 10 19:59:57 2017 - Sun Apr 16 04:00:28 2017 (5+08:00)
reboot system boot 4.4.46-11-defaul Mon Apr 10 19:58:40 2017 - Sun Apr 16 04:00:28 2017 (5+08:01)
runlevel (to lvl 5) 4.4.46-11-defaul Sat Apr 8 17:23:57 2017 - Mon Apr 10 08:19:12 2017 (1+14:55)
reboot system boot 4.4.46-11-defaul Sat Apr 8 17:22:39 2017 - Mon Apr 10 08:19:12 2017 (1+14:56)
runlevel (to lvl 5) 4.4.46-11-defaul Sat Apr 8 00:16:16 2017 - Sat Apr 8 11:06:55 2017 (10:50)
reboot system boot 4.4.46-11-defaul Sat Apr 8 00:15:02 2017 - Sat Apr 8 11:06:55 2017 (10:51)
runlevel (to lvl 5) 4.4.46-11-defaul Thu Apr 6 18:47:55 2017 - Sat Apr 8 00:04:46 2017 (1+05:16)
reboot system boot 4.4.46-11-defaul Thu Apr 6 18:46:43 2017 - Sat Apr 8 00:04:46 2017 (1+05:18)
runlevel (to lvl 5) 4.4.46-11-defaul Wed Apr 5 17:44:46 2017 - Thu Apr 6 11:30:26 2017 (17:45)
reboot system boot 4.4.46-11-defaul Wed Apr 5 17:43:40 2017 - Thu Apr 6 11:30:26 2017 (17:46)
runlevel (to lvl 5) 4.4.46-11-defaul Tue Apr 4 21:37:25 2017 - Wed Apr 5 09:36:34 2017 (11:59)
reboot system boot 4.4.46-11-defaul Tue Apr 4 21:36:13 2017 - Wed Apr 5 09:36:34 2017 (12:00)
By subtracting the reboot time from the time the system reached run level 5 for each reboot process I get times that average close to 1 min 15 sec. Bear in mind, that is not how long the reboot takes from power on to to run level 5. It is how long it takes Linux to reach run level 5 after it gets control of the system. The time for POST and BIOS checks is not included in that. To find that time you would need a clock that matches the system's time exactly and record when you pushed the power button, and compare that to the reported time for the start of the boot process in last
. The difference being how long the computer takes to reach the point that it passes control to Linux.
I'll admit that I don't know at exactly what point in the process of booting corresponds to the logged time. I could be when the boot loader, probably GRUB, is started, or it could be when GRUB calls the kernel loaded, or even when the kernel is loaded, and begins to load everything else. Mere speculation on my part suggests that it is when GRUB is called. I have a short delay in my GRUB menu since I almost always boot into the same system, and will be waiting for it if I'm booting into anything else. Still, I'm often waiting for GRUB to load, and usually press Enter before the delay expires. That could account for the variation of six seconds between the minimum and maximum times from booting to run level 5. Of course, this is only speculation on my part.