- last command
- who command
You need to use the who command, to print who is logged on. It also displays the time of last system boot. Use the last command to display system reboot and shutdown date and time, run:
$ who –b
system boot Apr 30 15:08
Use the last command to display listing of last logged in users and system last reboot time and date, enter:
$ last reboot | less
Or, better try:
$ last reboot | head -1
reboot system boot 220.127.116.11 Sun Apr 30 15:08 - 16:22 (01:13)
The last command searches back through the file /var/log/wtmp and displays a list of all users logged in (and out) since that file was created. The pseudo user reboot logs in each time the system is rebooted. Thus last reboot command will show a log of all reboots since the log file was created.
Finding systems last shutdown date and time
To display last shutdown date and time use the following command:
$ last -x|grep shutdown | head -1
shutdown system down 18.104.22.168 Sun Apr 30 13:31 - 15:08 (01:37)
- -x: Display the system shutdown entries and run level changes.
Here is another session from my last command:
$ last -x
$ last -x reboot
$ last -x shutdown
OS X/Unix/FreeBSD find out last reboot and shutdown time command examples
Type the following command:
$ last reboot
Sample outputs from OS X unix:
reboot ~ Fri Dec 18 23:58 reboot ~ Mon Dec 14 09:54 reboot ~ Wed Dec 9 23:21 reboot ~ Tue Nov 17 21:52 reboot ~ Tue Nov 17 06:01 reboot ~ Wed Nov 11 12:14 reboot ~ Sat Oct 31 13:40 reboot ~ Wed Oct 28 15:56 reboot ~ Wed Oct 28 11:35 reboot ~ Tue Oct 27 00:00 reboot ~ Sun Oct 18 17:28 reboot ~ Sun Oct 18 17:11 reboot ~ Mon Oct 5 09:35 reboot ~ Sat Oct 3 18:57
wtmp begins Sat Oct 3 18:57
To see shutdown date and time, enter:
$ last shutdown
shutdown ~ Fri Dec 18 23:57 shutdown ~ Mon Dec 14 09:53 shutdown ~ Wed Dec 9 23:20 shutdown ~ Tue Nov 17 14:24 shutdown ~ Mon Nov 16 21:15 shutdown ~ Tue Nov 10 13:15 shutdown ~ Sat Oct 31 13:40 shutdown ~ Wed Oct 28 03:10 shutdown ~ Sun Oct 18 17:27 shutdown ~ Mon Oct 5 09:23
wtmp begins Sat Oct 3 18:57
How do I find who rebooted/shutdown the Linux box?
You need to enable psacct service and run the following command to see info about executed commands including user name. Type the following lastcomm command to see
# lastcomm userNameHere
# lastcomm commandNameHere
# lastcomm | more
# lastcomm reboot
# lastcomm shutdown
## OR see both reboot and shutdown time
# lastcomm | egrep 'reboot|shutdown'
reboot S X root pts/0 0.00 secs Sun Dec 27 23:49 shutdown S root pts/1 0.00 secs Sun Dec 27 23:45
So root user rebooted the box from 'pts/0' on Sun, Dec, 27th at 23:49 local time.
- For more information read last command man page and learn how to use the tuptime command on Linux server to see the historical and statistical uptime.