Uptime and who -b are showing different times when the system was last booted on Linux

Question

I have a Linux system where it is showing to me two different times when the system was last booted.

root@linux:~ # who -b; uptime
          system boot  2009-07-09 20:51 
11:48am  up 1 day  0:54,  1 user,  load average: 0.01, 0.03, 0.00

I presume that who is showing the content of /var/log/wtmp and uptime I have no idea.

Is there some way to fix this difference? I rebooted the system yesterday so I know the contents that uptime is showing me is correct.

Solution 1

[I caught some misconceptions here which I think will this post clear off eventually]

There should not be any difference since both refer to /var/run/utmp file, which has its own format to store the records. If at all there is any difference, then your utmp file is busted. uptime shows the amount of time that has passed since the system has been booted or how long the system has been running. It does not tell you the system clock or system boot time . System boot time information is stored /var/run/wtmp file.

[centos@centos temp]$ date; uptime; who -b
Fri Dec  9 20:41:40 IST 2011
 20:41:40 up  1:32,  2 users,  load average: 0.50, 0.37, 0.29
         system boot  2011-12-09 19:11

uptime refers as well /proc/uptime, which essentially keeps the counters in kernel.

[centos@centos temp]$ sleep 1; cat /proc/uptime; uptime; sleep 5; cat /proc/uptime ; uptime
5914.79 5271.83
 20:47:39 up  1:38,  2 users,  load average: 0.29, 0.31, 0.27
5920.07 5276.80
 20:47:44 up  1:38,  2 users,  load average: 0.56, 0.36, 0.29

/var/run/wtmp is referred by last/lastb commands. who & w refers /var/run/utmp file. last reboot will show a log of all reboots since the log file was created.

Additionally, if you are having /proc filesystem, then tool such as procinfo can give you bootup time as well.

Example:

bash$ procinfo | grep Bootup
Bootup: Wed Mar 21 15:15:50 2001 Load average: 0.04 0.21 0.34 3/47 6829

Solution 2

I've seen this happen when the BIOS clock is out of sync. You can verify that by running:

$ hwclock --show                  
Tue 30 Aug 2011 12:48:52 PM PDT  -1.000516 seconds

If this is off you should sync it back up (using the --set option). If you notice this happening frequently you probably need to change the CR2032 on your motherboard http://www.hardwaresecrets.com/article/81

Comments

[Admin]

Is the date of the system rightly set? If you boot again and go to the bios, is the date right?

[Admin]

when you reboot again, does who -b still show the same date (2009-07-09 20:51) or does it change ? The manpage of my who suggests that it is using /var/run/utmp if no file is specified. Are the write permissions for this file reasonable (user root and group utmp on my system) ? Is /var full ?

[Admin]

uptime reads /proc/uptime. who reads /var/run/utmp, which doesn't seem to be updated correctly. What distribution are you using?

[Admin]

Everything seems okay on my end (sorry, I forgot which host I had this issue but I found it) root@linux:~ # date Mon Aug 15 12:30:33 BRT 2011 root@linux:~ # ls -l /var/run/utmp -rw-rw-r-- 1 root tty 4992 2011-08-15 12:29 /var/run/utmp root@linux:~ # cat /etc/*release SUSE Linux Enterprise Server 10 (i586) VERSION = 10 PATCHLEVEL = 1

[setatakahashi]

No, my server is showing the correct hardware time. My guess is that there is a file that is read-only and is not being updated. But thanks for your suggestion.

[Rfraile]

The same happens with Tuptime, it register the bootup time at startup, but maybe later, if the system have some time drift, the uptime value changed. The root cause usually is because these tools look for the btime value in /proc/stat and this change with the drifts. It is easy to show if this happend looking into the value reported in the line INFO:Drift over btime when the program is executed in verbose mode tuptime -v