Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to track when the server was rebooted or shutdown. I used w and uptime to see how long it's been up but also used last -x to get a log of times when the server went down. Here is the output:

    runlevel (to lvl 2)   2.6.26-2-686     Wed Sep 14 09:38 - 10:22  (00:43)    
    reboot   system boot  2.6.26-2-686     Wed Sep 14 09:38 - 10:22  (00:43)    
    keenan   pts/1                         Tue Sep 13 16:07 - crash  (17:31)    
    keenan   pts/1                         Tue Sep 13 15:20 - 15:21  (00:01)    
    keenan   pts/2                         Mon Sep 12 14:51 - 09:16  (18:24)

I'm confused about the last column and what the time represented there means.

share|improve this question
up vote 2 down vote accepted

For actual user sessions, the time in parentheses is the duration of the login session in hours and minutes. For sessions lasting more than a day, it will be in the form "d+hh:mm", where "d" is the number of days.

For the non-user entries, the time is actually the system's current uptime. Compare it to the output of uptime to see. From a CentOS 5.6 system:

$ last -x | egrep 'runlevel|reboot|shutdown'
runlevel (to lvl 3)   2.6.18-238.19.1. Thu Sep  8 11:38 - 09:15 (5+21:37)
reboot   system boot  2.6.18-238.19.1. Thu Sep  8 11:38         (5+21:37)
shutdown system down  2.6.18-238.el5   Thu Sep  8 11:37 - 09:15 (5+21:37)

$ uptime
 09:15:32 up 5 days, 21:37,  2 users,  load average: 0.23, 0.21, 0.18
share|improve this answer

When the system is started the reboot event is logged. So in your case you can assume that the server has crashed a few minutes before Wed Sep 14 09:38.

From the man page:

The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all reboots since the log file was created.

share|improve this answer

I was about to be snotty and reply that you should read the man pages, but they are useless, they don't list the columns, nor does the command itself bother to label them.

My guess is that it's how long the person was logged in for (or the server was up for), but it's just a guess.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.