Wann Wurde Rechner Eingeschaltet Linux Protokoll

Find out exactly when your Linux computer was last booted using system logs

Comprehensive Guide: How to Determine When a Linux Computer Was Last Booted

Understanding when your Linux system was last booted is crucial for system administration, security auditing, and troubleshooting. This guide explores all methods to check boot times, including command-line tools, log file analysis, and systemd journal inspection.

1. Using the last Command

The last command reads from /var/log/wtmp and displays system boot times along with user login history.

last reboot
last -x | grep shutdown
last -x | grep boot

Key features:

• Shows reboot history with timestamps
• Includes shutdown events
• Displays user login sessions
• Works on most Linux distributions

2. Using journalctl (systemd Systems)

For modern Linux distributions using systemd, journalctl provides the most reliable boot time information:

journalctl –list-boots
journalctl -b -0 # Current boot
journalctl -b -1 # Previous boot

Advantages:

• Precise timestamps with microsecond accuracy
• Access to complete boot logs
• Filtering by boot session
• Structured output options (JSON, export)

3. Using uptime Command

The uptime command shows how long the system has been running:

uptime -p # Pretty format
uptime -s # Since timestamp

Output interpretation:

Command	Output Example	Meaning
uptime	14:25:36 up 3 days, 2:14, 2 users, load average: 0.15, 0.10, 0.05	System has been up for 3 days and 2 hours
uptime -s	2023-11-15 12:11:22	System booted at this exact time

4. Checking /proc/uptime

The kernel exposes uptime information through the proc filesystem:

cat /proc/uptime
awk ‘{print $1}’ /proc/uptime | xargs -I{} date -d @{} +’%Y-%m-%d %H:%M:%S’

Technical details:

• First value = seconds since boot
• Second value = idle time
• Requires conversion to human-readable format
• Most accurate for current session

5. Analyzing System Logs

Key log files containing boot information:

Log File	Location	Boot Information
syslog	/var/log/syslog	Kernel messages, service starts
messages	/var/log/messages	General system messages
dmesg	kernel ring buffer	Hardware initialization
boot.log	/var/log/boot.log	Detailed boot process

Search patterns for boot events:

grep -i “system boot” /var/log/syslog
grep -i “kernel command line” /var/log/dmesg
journalctl | grep “Startup finished”

6. Using who Command

The who command shows current login sessions and boot time:

who -b
who -a | grep boot

Output format:

• Shows system boot time in first column
• Displays current runlevel
• Simple and universally available

7. Advanced Methods for Forensic Analysis

For security investigations, consider these advanced techniques:

1. File access times: Check /etc directory modification times
2. Network connections: Analyze /var/log/auth.log for SSH sessions
3. Disk activity: Examine /var/log/kern.log for storage events
4. Temperature logs: Check /sys/class/thermal/ for hardware state changes

8. Automating Boot Time Monitoring

Create a cron job to log boot times automatically:

#!/bin/bash
BOOT_TIME=$(who -b | awk ‘{print $3,$4}’)
echo “$(date) – System boot time: $BOOT_TIME” >> /var/log/boot_history.log

Add to cron with:

sudo crontab -e
@reboot /path/to/boot_logger.sh

9. Comparing Different Methods

Method	Accuracy	Historical Data	System Impact	Best For
journalctl	⭐⭐⭐⭐⭐	⭐⭐⭐⭐⭐	Low	Modern systemd systems
last command	⭐⭐⭐⭐	⭐⭐⭐⭐	Very Low	Quick checks
uptime	⭐⭐⭐	⭐	None	Current session only
/proc/uptime	⭐⭐⭐⭐	⭐	None	Scripting
Log files	⭐⭐⭐	⭐⭐⭐⭐	Medium	Forensic analysis

10. Security Considerations

When investigating boot times for security purposes:

• Check for unexpected reboots that might indicate attacks
• Compare boot times with authentication logs
• Look for gaps in log files that might indicate tampering
• Use ausearch for audit trail analysis

Authoritative Resources

For official documentation and research:

• Linux Kernel Documentation – Official kernel boot process details
• Red Hat Enterprise Linux Documentation – Systemd and journalctl guides
• US-CERT Security Guidelines – Best practices for system monitoring

Frequently Asked Questions

Why would I need to know when my Linux system booted?

Common reasons include:

• Troubleshooting unexpected crashes or reboots
• Security auditing for unauthorized access
• Performance analysis of uptime patterns
• Compliance reporting for system availability
• Maintenance scheduling based on usage patterns

Can boot times be faked or altered?

While possible, it requires root access and leaves traces:

• Modifying system clocks affects timestamps
• Deleting log files leaves gaps in sequences
• File metadata (inode timestamps) can reveal tampering
• Modern systems use multiple independent logging mechanisms

How far back can I see boot history?

Depends on your system configuration:

Method	Default Retention	How to Extend
journalctl	Varies by distro (often 1-4 weeks)	Edit /etc/systemd/journald.conf
/var/log/wtmp	Indefinite (until log rotation)	Adjust logrotate settings
syslog	Typically 4-12 weeks	Modify /etc/logrotate.conf

What’s the most reliable method for production systems?

For enterprise environments, we recommend:

1. Configure centralized logging (ELK stack, Splunk)
2. Implement systemd journal persistence
3. Set up log file monitoring with Filebeat
4. Create automated alerts for unexpected reboots
5. Maintain at least 6 months of log history