Linux Find Out Last System Reboot Time and Date Command

So, how do you find out your Linux or UNIX-like system was last rebooted? How do you display the system shutdown date and time? The last utility will either list the sessions of specified users, ttys, and hosts, in reverse time order, or list the users logged in at a specified date and time. Each line of output contains the user name, the tty from which the session was conducted, any hostname, the start and stop times for the session, and the duration of the session. To view Linux or Unix system reboot and shutdown date and time stamp using the following commands:

  • last command
  • who command

Use who command to find last system reboot time/date

You need to use the who command, to print who is logged on. It also displays the time of last system boot. Use the last command to display system reboot and shutdown date and time, run:
$ who -b
Sample outputs:

         system boot  2017-06-20 17:41

Use the last command to display listing of last logged in users and system last reboot time and date, enter:
$ last reboot | less
Sample outputs:

Fig.01: last command in action

Or, better try:
$ last reboot | head -1
Sample outputs:
reboot   system boot  4.9.0-3-amd64    Sat Jul 15 19:19   still running

The last command searches back through the file /var/log/wtmp and displays a list of all users logged in (and out) since that file was created. The pseudo user reboot logs in each time the system is rebooted. Thus last reboot command will show a log of all reboots since the log file was created.

Finding systems last shutdown date and time

To display last shutdown date and time use the following command:
$ last -x|grep shutdown | head -1
Sample outputs:

shutdown system down  2.6.15.4         Sun Apr 30 13:31 - 15:08  (01:37)

Where,

  • -x: Display the system shutdown entries and run level changes.

Here is another session from my last command:
$ last
$ last -x
$ last -x reboot
$ last -x shutdown

Sample outputs:

Fig.01: How to view last Linux System Reboot Date/Time

Find out Linux system up since…

Another option as suggested by readers in the comments section below is to run the following uptime command:
$ uptime -s
Sample outputs:

2017-06-20 17:41:51

macOS (OS X)/Unix/FreeBSD find out last reboot and shutdown time command examples

Type the following last command:
$ last reboot
Sample outputs from OS X unix:

reboot    ~                         Fri Dec 18 23:58
reboot    ~                         Mon Dec 14 09:54
reboot    ~                         Wed Dec  9 23:21
reboot    ~                         Tue Nov 17 21:52
reboot    ~                         Tue Nov 17 06:01
reboot    ~                         Wed Nov 11 12:14
reboot    ~                         Sat Oct 31 13:40
reboot    ~                         Wed Oct 28 15:56
reboot    ~                         Wed Oct 28 11:35
reboot    ~                         Tue Oct 27 00:00
reboot    ~                         Sun Oct 18 17:28
reboot    ~                         Sun Oct 18 17:11
reboot    ~                         Mon Oct  5 09:35
reboot    ~                         Sat Oct  3 18:57 
wtmp begins Sat Oct 3 18:57

To see shutdown date and time, enter:
$ last shutdown
Sample outputs:

shutdown  ~                         Fri Dec 18 23:57
shutdown  ~                         Mon Dec 14 09:53
shutdown  ~                         Wed Dec  9 23:20
shutdown  ~                         Tue Nov 17 14:24
shutdown  ~                         Mon Nov 16 21:15
shutdown  ~                         Tue Nov 10 13:15
shutdown  ~                         Sat Oct 31 13:40
shutdown  ~                         Wed Oct 28 03:10
shutdown  ~                         Sun Oct 18 17:27
shutdown  ~                         Mon Oct  5 09:23 
wtmp begins Sat Oct 3 18:57

How do I find who rebooted/shutdown the Linux box?

You need to enable psacct service and run the following command to see info about executed commands including user name. Type the following lastcomm command along with the grep command/egrep command to see:
# lastcomm userNameHere
# lastcomm commandNameHere
# lastcomm | more
# lastcomm reboot
# lastcomm shutdown
## OR see both reboot and shutdown time
# lastcomm | egrep 'reboot|shutdown'

Sample outputs:

reboot           S   X root     pts/0      0.00 secs Sun Dec 27 23:49
shutdown         S     root     pts/1      0.00 secs Sun Dec 27 23:45

So root user rebooted the box from ‘pts/0’ on Sun, Dec, 27th at 23:49 local time.

Conclusion

🐧 If you liked this page, please support my work on Patreon or with a donation.
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source & DevOps topics via:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
19 comments… add one
  • JK Jul 15, 2017 @ 20:54

    Seriously? No one came up with a simple ‘uptime -s’ ?

    • 🐧 Vivek Gite Jul 17, 2017 @ 13:32

      Thanks for the comments. The post has been updated.

  • Brandom H. Sep 3, 2015 @ 6:48

    Hi!

    tuptime is an other command that you can use for get this information. I found it after trying all the typical commands. I think that it covers better this subject that the solutions proposed here

    An example, with enumerate option:

    # tuptime -e
    Startup: 1 at 08:25:03 AM 08/28/2015
    Uptime: 14 minutes and 38 seconds
    Shutdown: OK at 08:39:41 AM 08/28/2015

    Downtime: 6 seconds

    Startup: 2 at 08:39:48 AM 08/28/2015
    Uptime: 10 minutes and 36 seconds
    Shutdown: BAD at 08:50:24 AM 08/28/2015

    Downtime: 7 minutes and 16 seconds

    Startup: 3 at 08:57:41 AM 08/28/2015
    Uptime: 10 minutes and 22 seconds
    Shutdown: BAD at 09:08:03 AM 08/28/2015

    Downtime: 6 minutes and 12 seconds

    Startup: 4 at 09:14:16 AM 08/28/2015
    Uptime: 1 minutes and 7 seconds
    Shutdown: BAD at 09:15:23 AM 08/28/2015

    Downtime: 2 minutes and 35 seconds

    Startup: 5 at 09:17:59 AM 08/28/2015
    Uptime: 1 minutes and 15 seconds
    Shutdown: BAD at 09:19:14 AM 08/28/2015

    Downtime: 8 hours, 32 minutes and 8 seconds

    Startup: 6 at 05:51:23 PM 08/28/2015
    Uptime: 2 days, 16 hours, 53 minutes and 19 seconds
    Shutdown: BAD at 10:44:42 AM 08/31/2015

    Downtime: 22 hours, 13 minutes and 17 seconds

    Startup: 7 at 08:58:00 AM 09/01/2015
    Uptime: 7 hours, 23 minutes and 51 seconds
    Shutdown: OK at 04:21:51 PM 09/01/2015

    Downtime: 11 seconds

    Startup: 8 at 04:22:03 PM 09/01/2015
    Uptime: 41 seconds
    Shutdown: OK at 04:22:44 PM 09/01/2015

    Downtime: 6 seconds

    Startup: 9 at 04:22:51 PM 09/01/2015
    Uptime: 4 minutes and 11 seconds
    Shutdown: OK at 04:27:02 PM 09/01/2015

    Downtime: 5 seconds

    Startup: 10 at 04:27:08 PM 09/01/2015
    Uptime: 1 days, 16 hours, 14 minutes and 32 seconds

    System startups: 10 since 08:25:03 AM 08/28/2015
    System shutdowns: 4 ok – 5 bad
    Average uptime: 11 hours, 19 minutes and 27 seconds
    Average downtime: 3 hours, 6 minutes and 12 seconds
    Current uptime: 1 days, 16 hours, 14 minutes and 32 seconds since 04:27:08 PM 09/01/2015
    Uptime rate: 78.49 %
    Downtime rate: 21.51 %
    System uptime: 4 days, 17 hours, 14 minutes and 35 seconds
    System downtime: 1 days, 7 hours, 2 minutes and 1 seconds
    System life: 6 days, 0 hours, 16 minutes and 37 seconds

    The repository is located at: https://github.com/rfrail3/tuptime

    Regards,

  • Velma Mar 23, 2015 @ 7:18

    Thank u 🙂 for info

  • Albert Diones Mar 4, 2015 @ 21:07

    Is there any way to check if the system is currently rebooting? Or shutting down

    I made a cron job that will reboot the server when a specific file exists (deleting that file too of course)
    So that I can use php to make it and signal a reboot when needed
    When cron job fires, the few seconds of shutting down will trigger database connection error
    So I want to know if there is any standard way of knowing the system is rebooting aside from making another file that existence signals “server is rebooting” (which I don’t know how to delete when server is back up anyway)

  • alexander Nov 17, 2011 @ 20:47

    last | grep USERNAME | grep tty | head -n 1 |awk -F ‘ ‘ ‘{print $7}’

  • Sam Hocevar Mar 28, 2011 @ 14:34

    wtmp is rotated by the system, so the last solution will stop working. I believe the most reliable solution is:

    date -d "`cut -f1 -d. /proc/uptime` seconds ago"
    • lavermil Jun 13, 2011 @ 21:02

      The uptime idea from Sam is nice but really that just returns the uptime (same as the uptime command) in date format.

  • L_kernel Sep 23, 2010 @ 13:38

    Thanks a lot!
    I help me!

  • Ajeet Aug 17, 2010 @ 10:12

    Can we find who rebooted the linux box?

    • Nick Mar 16, 2011 @ 23:48

      In order to track who rebooted a linux machine, I would:
      – disable root logins; many users sharing root is bad
      – create a list of sudoers, so only people listed there could shutdown / reboot / halt
      – /var/log/messages would contain traces of who ran sudo shutdown -r now or such

  • xera Dec 6, 2009 @ 15:04

    the command “last reboot” worked for me, on my mac!

  • diana Oct 16, 2007 @ 3:45

    Thanks vivek.its working great…..

  • 🐧 nixCraft Oct 15, 2007 @ 14:12

    My bad…I forgot to include double quote …

    59 11 * * * last | grep "$(date '+%a %b %d')" > /tmp/users.out ; mail -s “Users Logged"

    Also you may wanna try out:

    last -t yyyymmddhhmmss

    HTH

  • diana Oct 15, 2007 @ 13:25

    thanks a lot vivek.i din’t expect this much fast reply.But unfortunately when i execute,
    $ last | grep $(date ‘+%a %b %d’)
    i couldn’t get anything.Please help

  • 🐧 nixCraft Oct 15, 2007 @ 13:06

    Should be..

    59 11 * * * last | grep $(date '+%a %b %d') > /tmp/users.out ; mail -s “Users Logged"
  • diana Oct 15, 2007 @ 12:57

    i couldn’t find out the error. please help me.

    #Send list of users logged on to server via email
    59 11 * * * last | grep date ‘+%a %b %d’ > /tmp/users.out ; mail -s “Users Logged Today” ephrondiana@gmail.com

    when i tried to execute,
    $ last |grep date ‘+%a %b %d’
    i got no such file or directory error.

  • jamshid Feb 22, 2007 @ 11:29

    On my FC5 system instead of
    last reboot | head -1
    I can type
    last reboot -1

    • Roshan Oct 28, 2014 @ 7:32

      Please give a try by your own!! I think it will not work dude.

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.