These seem to match up perfectly:
Quote:
Originally Posted by devUnix
Code:
$ date
Mon Dec 2 19:25:29 EST 2013
$ uptime
19:25:03 up 20 days, 4:41, 3 users, load average: 0.10, 0.08, 0.02
$ who -b
system boot 2013-11-12 14:43
|
Subtracting 20 days and 4:41 as reported by
uptime from the current date/time (Dec 2 19:25) gives you Nov 12 14:44, and the one minute difference between that and
who -b is probably just due to the seconds getting truncated or rounded.
Quote:
Originally Posted by devUnix
Code:
$ last boot
wtmp begins Fri Sep 7 14:12:08 2012
$ last | grep boot
reboot system boot 2.6.32-279.el6.x Tue Nov 12 14:43 - 19:25 (20+04:41)
reboot system boot 2.6.32-279.el6.x Tue Nov 12 14:30 - 14:40 (00:10)
reboot system boot 2.6.32-279.el6.x Tue Nov 12 14:15 - 14:27 (00:12)
reboot system boot 2.6.32-279.el6.x Wed May 22 17:04 - 14:12 (173+22:07)
reboot system boot 2.6.32-279.el6.x Mon Jan 28 14:44 - 17:00 (114+01:16)
|
The top entry seems to match
uptime/who -b.
The start of wtmp does not match the system boot time on any of my systems either. Should it? I have one starting back in June 2010 when the system in question was first installed. FWIW,
last | grep boot returns nothing on one of my systems, even though that system has surely been rebooted a number of times.
Quote:
Originally Posted by devUnix
Also... how do we figure out if the system has been warm (soft) rebooted or cold (hard) rebooted?
|
A hard reboot due to power failure, system lockup or a kernel panic will leave no trace of a shutdown event in the logs. If you see log entries indicating the system has booted without entries for a corresponding shutdown immediately preceding them, there's been a crash of some kind.
