2

I want know the boot and shutdown date of my laptop on last friday:

===> last reboot
reboot   system boot  4.4.0-47-generic Mon Nov 28 09:39   still running
reboot   system boot  4.4.0-45-generic Fri Nov 25 09:40 - 15:55  (06:14)

According to this output the laptop was switched on from 9:40 to 15:55.

see this in my bash history. The shutdown times match:

===> history | grep 2016-11-25| tail
24911  2016-11-25 15:51:33 :... some command

But the start time does not:

===> history | grep 2016-11-25| head
24850  2016-11-25 08:58:35 :ssh somehost
24851  2016-11-25 08:47:01 :...

I think there is something wrong.

I checked my boot/shutdown times with a different tool the last 5 days, and this reveals: The output of last reboot is wrong. Every day one hour is missing.

Do your time of last reboot match?

Update, two years later, I found the solution: https://serverfault.com/a/958823/90324

guettli
  • 1,765

2 Answers2

2

Probably your hardware clock is in UTC. And maybe your system is in CET. Therefore when you boot your computer, the first log entries will be in UTC.

Carl
  • 744
1

I personally prefer to use the kernal logs to find out when a system was turned off and on again, simply because it's far more verbose than the output of last reboot, though you'll need to scan over the log files to find what you're after (I usually grep through them) .

They can be found in /var/log/, and should look similar to this:

-rw-r-----  1 syslog            adm    181476 Nov 30 18:34 kern.log
-rw-r-----  1 syslog            adm    185878 Nov 29 16:42 kern.log.1
-rw-r-----  1 syslog            adm     46081 Nov 21 20:05 kern.log.2.gz
-rw-r-----  1 syslog            adm     41326 Nov 14 18:19 kern.log.3.gz
-rw-r-----  1 syslog            adm     16143 Nov  8 20:32 kern.log.4.gz

Your history command simply shows the command line history, and thus is inherently a flawed source of shutdown/start/reboot data, in that you may not have run a command right before you shut down the machine (if you used the GUI to shut down).