Interpreting last reboot output

Question

According to this webpage titled, “Linux Find Out Last System Reboot Time and Date Command” I can do last reboot | head -1 to see when my system was last rebooted. The output I get looks similar to the output they provide:

reboot   system boot  3.13.0-116-gener Thu Apr 13 14:12 - 20:09  (05:56)

My question is what does the 14:12 - 20:09 part mean? Does that mean the system began the reboot process at 2:12pm and ended at 8:09pm? Because that seems highly improbable to me.

Solution 1

Run last reboot -F and the output should be clearer. The -F option means:

Print full login and logout times and dates.

So those values show the timespan between reboots.

Solution 2

It means that the system booted at 14:12 and was shut down at 20:09, for a total uptime of 5:56.

---

TL;DR

In the case where it is the most recent entry, as in the question with | head -1, the shut down time is the current system time, and the uptime reflects how long the system has been running currently. All the remaining lines that are in the log, show if you don't use head to limit the output, show the actual shut down time and uptime for the system beginning at the date and time given.

For example, on my system last reboot | head -6 gives:

reboot   system boot  4.4.46-11-defaul Mon Apr 10 19:58 - 04:00 (5+08:00)
reboot   system boot  4.4.46-11-defaul Sat Apr  8 17:22 - 08:19 (1+14:56)
reboot   system boot  4.4.46-11-defaul Sat Apr  8 00:15 - 11:06  (10:51)
reboot   system boot  4.4.46-11-defaul Thu Apr  6 18:46 - 00:04 (1+05:18)
reboot   system boot  4.4.46-11-defaul Wed Apr  5 17:43 - 11:30  (17:46)
reboot   system boot  4.4.46-11-defaul Tue Apr  4 21:36 - 09:36  (12:00)

That translates into the following sequence, reversing the order:

    Booted     Shut Down    System up for 
------------  ------------  -------------
Apr  4 21:36  Apr  5 09:36          12:00
Apr  5 17:43  Apr  6 11:30          17:46
Apr  6 18:46  Apr  8 00:04    1 day 05:18
Apr  8 00:15  Apr  8 11:06          10:51
Apr  8 17:22  Apr 10 08:19    1 day 14:56
Apr 10 19:58  Still running  5 days 08:00 (so far)

The first line, which is the most recent boot, will not have its shut down time finalized until the system is actually shut down. Instead, it will display the current time every time you run the last reboot command.

So you are correct in that it's improbable that the reboot process started at 2:12pm and ended at 8:09pm. If that were true, it would be time to do some serious work on your system! How long the reboot process took is not reflected in that output, rather it is how long the system has been running since it was booted. The last command does not give that information directly. It does, however, give entries that can help you figure out how long the process takes, roughly.

To do this you need to include the -x option which adds the system runlevel and shutdown entries to the output. To filter the output look for both the reboot pseudo-user and the runlevel pseudo-user. To make last add seconds to the reported times use the -F option, which expands the time entries to full date and time, including seconds. Also, there will be two entries for each boot process rather than one, so you need to double the number passed to the head command; if I want the last 6 reboots, as above, I'll need to use -12 this time.

Executing last -xF reboot runlevel | head -12 gives:

runlevel (to lvl 5)   4.4.46-11-defaul Mon Apr 10 19:59:57 2017 - Sun Apr 16 04:00:28 2017 (5+08:00)   
reboot   system boot  4.4.46-11-defaul Mon Apr 10 19:58:40 2017 - Sun Apr 16 04:00:28 2017 (5+08:01)   
runlevel (to lvl 5)   4.4.46-11-defaul Sat Apr  8 17:23:57 2017 - Mon Apr 10 08:19:12 2017 (1+14:55)   
reboot   system boot  4.4.46-11-defaul Sat Apr  8 17:22:39 2017 - Mon Apr 10 08:19:12 2017 (1+14:56)   
runlevel (to lvl 5)   4.4.46-11-defaul Sat Apr  8 00:16:16 2017 - Sat Apr  8 11:06:55 2017  (10:50)    
reboot   system boot  4.4.46-11-defaul Sat Apr  8 00:15:02 2017 - Sat Apr  8 11:06:55 2017  (10:51)    
runlevel (to lvl 5)   4.4.46-11-defaul Thu Apr  6 18:47:55 2017 - Sat Apr  8 00:04:46 2017 (1+05:16)   
reboot   system boot  4.4.46-11-defaul Thu Apr  6 18:46:43 2017 - Sat Apr  8 00:04:46 2017 (1+05:18)   
runlevel (to lvl 5)   4.4.46-11-defaul Wed Apr  5 17:44:46 2017 - Thu Apr  6 11:30:26 2017  (17:45)    
reboot   system boot  4.4.46-11-defaul Wed Apr  5 17:43:40 2017 - Thu Apr  6 11:30:26 2017  (17:46)    
runlevel (to lvl 5)   4.4.46-11-defaul Tue Apr  4 21:37:25 2017 - Wed Apr  5 09:36:34 2017  (11:59)    
reboot   system boot  4.4.46-11-defaul Tue Apr  4 21:36:13 2017 - Wed Apr  5 09:36:34 2017  (12:00)    

By subtracting the reboot time from the time the system reached run level 5 for each reboot process I get times that average close to 1 min 15 sec. Bear in mind, that is not how long the reboot takes from power on to to run level 5. It is how long it takes Linux to reach run level 5 after it gets control of the system. The time for POST and BIOS checks is not included in that. To find that time you would need a clock that matches the system's time exactly and record when you pushed the power button, and compare that to the reported time for the start of the boot process in last. The difference being how long the computer takes to reach the point that it passes control to Linux.

---

I'll admit that I don't know at exactly what point in the process of booting corresponds to the logged time. I could be when the boot loader, probably GRUB, is started, or it could be when GRUB calls the kernel loaded, or even when the kernel is loaded, and begins to load everything else. Mere speculation on my part suggests that it is when GRUB is called. I have a short delay in my GRUB menu since I almost always boot into the same system, and will be waiting for it if I'm booting into anything else. Still, I'm often waiting for GRUB to load, and usually press Enter before the delay expires. That could account for the variation of six seconds between the minimum and maximum times from booting to run level 5. Of course, this is only speculation on my part.