In this blog post, we will explore various methods to determine the last time your Linux system was rebooted.
This information is invaluable for troubleshooting, performance monitoring, and general system administration.
We will delve into the usage of several powerful terminal commands: last, who -b, uptime -s, dmesg, and the more modern journalctl.
Table of Contents
1. The last Command: A Historical View
The last command is an excellent tool for viewing the history of user logins and system reboots. It gathers this information by reading from the /var/log/wtmp file, which records all logins and logouts.
To see a history of reboot times, use the following command:
last reboot
The output will list all reboot events since the wtmp log file was created. For a more concise view showing only the most recent reboots, you can pipe the output to head:
last reboot | head -2
Example Output:
reboot system boot 5.15.0-48-generic Mon Sep 26 10:15 still running
reboot system boot 5.15.0-47-generic Fri Sep 23 18:30 - 10:12 (2+15:42)
This output indicates the current session started on Monday, September 26th at 10:15. The line below it shows the previous reboot occurred on Friday, September 23rd.
The last command can also display the system’s shutdown times with the shutdown argument:
last shutdown | head -2
2. The uptime Command: A Quick and Simple Check
The uptime command provides a quick snapshot of how long your system has been running. To get the precise date and time of the last boot, use the -s (since) flag:
uptime -s
See also: Mastering the Linux Command Line — Your Complete Free Training Guide
Example Output:
2025-09-26 10:15:23
The main drawback of this method is that it only provides information about the current boot cycle.
3. The who Command: Identifying the Last Boot Time
The who command displays who is logged on. When used with the -b flag, it will show the time of the last system boot.
who -b
Example Output:
system boot 2025-09-26 10:15
Similar to uptime -s, this command is limited to displaying information about the current boot session.
4. The dmesg Command: Searching Through Kernel Messages
The dmesg command prints the kernel ring buffer, which contains a wealth of information about the kernel’s activities, including messages from the boot process. By filtering this output, we can find the system’s boot time. A reliable way to do this is to search for the “Linux version” string, which is one of the first messages logged by the kernel upon booting.
dmesg | grep "Linux version"
Example Output:
[ 0.000000] Linux version 5.15.0-48-generic (buildd@lcy02-amd64-025) (gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #54-Ubuntu SMP Fri Aug 26 13:26:29 UTC 2022 (Ubuntu 5.15.0-48.54-generic 5.15.53)
The timestamp [ 0.000000] at the beginning confirms this is the start of the kernel log for the current boot.
5. journalctl: The Modern Approach for Systemd
On most modern Linux distributions that use systemd, the journalctl command is the most powerful tool for inspecting system logs. It provides detailed information about past and present boot sessions.
To see a list of all recorded boots, use the --list-boots option:
journalctl --list-boots
Example Output:
-2 1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p Fri 2025-09-23 18:30:15 UTC—Mon 2025-09-26 10:12:30 UTC
-1 a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6 Mon 2025-09-26 10:15:20 UTC—Fri 2025-09-26 15:30:00 UTC
0 f0e9d8c7b6a5s4d3f2g1h2j3k4l5m6n7 Fri 2025-09-26 15:32:05 UTC—...
To view the logs specifically for the current boot, you can use the -b flag:
journalctl -b
For logs of a previous boot, you can specify the boot offset. For instance, to see the logs from the last boot, use:
journalctl -b -1
By mastering these commands, you can efficiently retrieve detailed information about your Linux system’s reboot history, aiding in more effective system management and troubleshooting.
