Linux: Finding out last reboot time (different approaches)

There are a few ways to find out when the Linux system was rebooted last time.

utmp

The first one is by using the data on the current boot stored in /var/run/utmp (and /run/utmp) file. Since the data is stored in a binary format, we can't access it directly, but we can use the who command.

By executing who -a, you should see a lot of data on the current boot:

           system boot  2020-11-24 11:07
           run-level 5  2020-11-24 11:07
LOGIN      tty1         2020-11-24 11:08               679 id=tty1
LOGIN      ttyS0        2020-11-24 11:08               678 id=tyS0
...

Since we're interested only in time of the last system boot (the first line), we can limit the output with -b switch (shorthand for --boot):

who -b

Result:

         system boot  2020-11-24 11:07

uptime

Alternatively, we can use the data from /proc/uptime, which contains the number of seconds since the system has been up.

We can either read and parse the /proc/uptime file directly, or use the uptime command, which by default returns output like this:

 22:24:11 up 817 days, 11:16, ...

More info on this approach: Linux: Finding out uptime of the system by reading ∕proc∕uptime

wtmp

There's also the /var/log/wtmp file which contains historical utmp data. As with utmp, it's a binary file, so we can't read it directly, but we can use the last command.

If we execute last reboot, we may get something like this:

reboot   system boot  4.19.0-12-amd64  Tue Nov 24 11:07   still running

wtmp begins Sun Nov  1 05:37:31 2020

The problem with this method is that wtmp file may get rotated, so we may get partial data. Generally, uptime and utmp are better methods to find out this information.

Ask me anything / Suggestions