The purpose of the 10th column of the `last` command’s output

last

I see a suspicious pattern in a last command output on RHEL:

$ last reboot
reboot   system boot  3.10.0-514.21.1. Wed Dec 13 10:25 - 11:53  (01:28)    
reboot   system boot  3.10.0-514.21.1. Mon Oct 30 16:23 - 11:53 (43+20:30)  
reboot   system boot  3.10.0-514.21.1. Fri Oct 20 16:53 - 11:53 (53+20:00)  
reboot   system boot  3.10.0-514.21.1. Mon Oct 16 09:21 - 11:53 (58+03:32)  
reboot   system boot  3.10.0-514.21.1. Fri Aug 25 15:53 - 11:53 (109+21:00) 
reboot   system boot  3.10.0-514.21.1. Tue Aug 22 15:36 - 11:53 (112+21:16) 
reboot   system boot  3.10.0-514.21.1. Fri Jul 21 16:38 - 11:53 (144+20:15) 
reboot   system boot  3.10.0-514.21.1. Fri Jun  9 15:00 - 16:18 (42+01:17)  
reboot   system boot  3.10.0-514.21.1. Mon Jun  5 11:20 - 16:18 (46+04:57)  
reboot   system boot  3.10.0-514.21.1. Thu Jun  1 09:49 - 16:18 (50+06:28)  
reboot   system boot  3.10.0-514.el7.x Wed May 31 17:46 - 09:49  (16:02)

Namely, the 10th column shows the same time datum on several rows (e.g., 11:53 seven times, and 16:18 three times).

The man page does not explain what each column should represent.

Do you know the purpose of the 10th column of the last command's output?

Best Answer

When listing reboots, the tenth column shows the last “down time” following the boot, i.e. the time at which the system was shut down, as far as last can determine. This actually involves combining multiple records from the information stored in the system; to do so, last keeps track of the last down time it’s seen, and uses that blindly when it displays a “reboot” line.

Thus if the system is shut down abruptly, the shut down time won’t be stored, and last will use the previous record instead. Looking at your results:

reboot   system boot  3.10.0-514.21.1. Wed Dec 13 10:25 - 11:53  (01:28)    
reboot   system boot  3.10.0-514.21.1. Mon Oct 30 16:23 - 11:53 (43+20:30)  
reboot   system boot  3.10.0-514.21.1. Fri Oct 20 16:53 - 11:53 (53+20:00)  
reboot   system boot  3.10.0-514.21.1. Mon Oct 16 09:21 - 11:53 (58+03:32)  
reboot   system boot  3.10.0-514.21.1. Fri Aug 25 15:53 - 11:53 (109+21:00) 
reboot   system boot  3.10.0-514.21.1. Tue Aug 22 15:36 - 11:53 (112+21:16) 
reboot   system boot  3.10.0-514.21.1. Fri Jul 21 16:38 - 11:53 (144+20:15) 
reboot   system boot  3.10.0-514.21.1. Fri Jun  9 15:00 - 16:18 (42+01:17)  
reboot   system boot  3.10.0-514.21.1. Mon Jun  5 11:20 - 16:18 (46+04:57)  
reboot   system boot  3.10.0-514.21.1. Thu Jun  1 09:49 - 16:18 (50+06:28)  
reboot   system boot  3.10.0-514.el7.x Wed May 31 17:46 - 09:49  (16:02)

last found a record indicating a shut down at 11:53 on December 13, and then several records indicating a start time; so it used that single shut down time for all of them. Then it found a shut down record for 42 days after June 9, at 16:18, and used that, again several times because it didn’t find any other shut down record until 09:49 on June 1.

You can see this in the last source code; search for “lastdown” to find where it’s updated (and used).

Related Question