If you have a very free daily schedule1, and you always have computer turned on almost the first thing you wake up and turned off the last thing before you go to bed, have you ever asked yourself: what did I get up this morning, or yesterday afternoon?

The answer or solution might be easy, just run uptime and you will get the system uptime. But sometimes, after system gets updated, you reboot your system and uptime resets. So what do you do?

About a couple of weeks ago, I even thought of writing a script to parse /var/log/messages. But it turns out just silly and quite unreliable, especially when there is already a great command last telling you the answer. For unknown reasons, probably due to lack of caffeine, I did run last before thought of making a parser but somehow I didn’t know it’s giving me the answer until I ran it again a few days ago.

1   last

The sample output looks like:

$ last
livibett tty1                          Thu Apr 11 10:07 - 10:07  (00:00)
reboot   system boot  3.7.10-gentoo-1  Thu Apr 11 10:02 - 22:27  (12:25)
livibett tty1                          Wed Apr 10 10:35 - 10:35  (00:00)
reboot   system boot  3.7.10-gentoo-1  Wed Apr 10 10:35 - 23:49  (13:14)
[snip]
reboot   system boot  3.7.10-gentoo-1  Tue Apr  2 09:21 - 00:10  (14:49)
livibett tty1                          Mon Apr  1 16:11 - 16:11  (00:00)
reboot   system boot  3.7.10-gentoo-1  Mon Apr  1 16:11 - 03:36  (11:24)

wtmp begins Mon Apr  1 16:11:00 2013

You can see me logging via tty1 and system reboot. Each log has login time, logout time, and session length. In the second line of output, my computer has been up for 12 hours and 25 minutes. What you need to read it the reboot lines, for which it’s a pseudo user name.

2   last -aF reboot | tac

After I played with its options, I think this command suits me better:

$ last -aF reboot | tac
wtmp begins Mon Apr  1 16:11:00 2013

reboot   system boot  Mon Apr  1 16:11:40 2013 - Tue Apr  2 03:36:39 2013  (11:24)     3.7.10-gentoo-1
reboot   system boot  Tue Apr  2 09:21:36 2013 - Wed Apr  3 00:10:37 2013  (14:49)     3.7.10-gentoo-1
reboot   system boot  Wed Apr  3 08:15:02 2013 - Wed Apr  3 23:20:48 2013  (15:05)     3.7.10-gentoo-1
reboot   system boot  Thu Apr  4 08:51:51 2013 - Fri Apr  5 02:44:57 2013  (17:53)     3.7.10-gentoo-1
reboot   system boot  Fri Apr  5 15:49:00 2013 - Sat Apr  6 13:36:26 2013  (21:47)     3.7.10-gentoo-1
reboot   system boot  Sat Apr  6 20:01:42 2013 - Sat Apr  6 23:10:04 2013  (03:08)     3.7.10-gentoo-1
reboot   system boot  Sun Apr  7 08:43:16 2013 - Mon Apr  8 02:31:12 2013  (17:47)     3.7.10-gentoo-1
reboot   system boot  Mon Apr  8 10:29:24 2013 - Tue Apr  9 00:48:25 2013  (14:19)     3.7.10-gentoo-1
reboot   system boot  Tue Apr  9 08:52:55 2013 - Wed Apr 10 04:10:19 2013  (19:17)     3.7.10-gentoo-1
reboot   system boot  Wed Apr 10 10:35:01 2013 - Wed Apr 10 23:49:54 2013  (13:14)     3.7.10-gentoo-1
reboot   system boot  Thu Apr 11 10:02:46 2013 - Thu Apr 11 22:32:04 2013  (12:29)     3.7.10-gentoo-1

The output lines are reversed by tac, -a option puts the kernel release in the end of line, -F prints out full dates and times. reboot tells last that we are only interested in reboot user.

3   -x

This options will include runlevel changes and shutdown entries. For example,

$ last -x
[snip]
livibett tty1                          Tue Apr  2 09:21 - 09:22  (00:00)
runlevel (to lvl 3)   3.7.10-gentoo-1  Tue Apr  2 09:21 - 00:10  (14:49)
reboot   system boot  3.7.10-gentoo-1  Tue Apr  2 09:21 - 00:10  (14:49)
shutdown system down  3.7.10-gentoo-1  Tue Apr  2 03:36 - 09:21  (05:44)
runlevel (to lvl 0)   3.7.10-gentoo-1  Tue Apr  2 03:36 - 03:36  (00:00)
livibett tty1                          Mon Apr  1 16:11 - 16:11  (00:00)
runlevel (to lvl 3)   3.7.10-gentoo-1  Mon Apr  1 16:11 - 03:36  (11:24)
reboot   system boot  3.7.10-gentoo-1  Mon Apr  1 16:11 - 03:36  (11:24)
shutdown system down  3.7.10-gentoo-1  Mon Apr  1 16:11 - 16:11  (00:00)
runlevel (to lvl 6)   3.7.10-gentoo-1  Mon Apr  1 16:11 - 16:11  (00:00)

wtmp begins Mon Apr  1 16:11:00 2013

The last line to lvl 6 tells that I ran reboot command on April 1. This would be helpful to know when you issue an reboot command.

When you read the reboot lines, you know how long your computer was running; and when you read the shutdown lines, they tell you how long it’s not powered up.

[1]Meaning you don’t have schedule at all.