MacSwitching.com > The LAST reboot – how much time has passed since the last rebooting? A hands-on LAST tutorial.

The LAST reboot – how much time has passed since the last rebooting? A hands-on LAST tutorial for Mac OS X (and BSD as well).

Preface
This is no earthshaking news, just a little bunch of info and real-life experience by myself: it may be well known to you or not.
It’s just my 50 cent contribution.

As every good Mac OS X user, I usually reboot only when really needed.
Two recent events occurred and required me to reboot and shutdown completely (respectively) my G4 Powerbook.
First of all I applied Apple’s latest Security update, a major one involving a huge number of system components as well as major apps.
In second place I got a 1 GB SODIMM from an ebay auction at a real bargain price.
In short: I applied the patch and shutdown the Powerbook in order to put the 1 Gig beside the original 512 MB – grand total 1.5 GB, a different life!

Just like many (if not all) Powerbook users, I’m so used to just STOP my Powerbook instead of shutting it off that sometimes I even forget when was the last time I rebooted it.
After the RAM upgrade I asked myself this very question and proceeded as follows:
– opening the Terminal
– last|more
– checking for the first shutdown/reboot item.

Right?
Wrong…

As a part of the DAILY/WEEKLY/MONTHLY rotation of log files, Mac OS X told me that the ‘history’ has changed so much and that:

wtmp begins Mon May 8 12:03

therefore, there’s no evidence/log before that date – and no shutdown/reboot recently…

So what?
Ok, let’s get back to basics:

man last

The LAST command, quite powerful allows us to report on login by users AND TTYs (remote).

The right syntax is, of course, as of

last --h

usage: last [-#] [-f file] [-t tty] [-h hostname] [user ...]

So LAST it’s able to read not only from the current WTMP (the log file that SYSLOG is updating), but even an older/different WTMP provided by the user.
Time to look for the WTMPs graveyard, that is, where the system’s CRON put all the older WTMPs.

If you don’t know the answer, just do a:

locate wtmp

As expected all files are GZIPped under /private/var/log and usually all logs are under /var/log
What’s inside there?
Typing:

ls -al /private/var/log/wtmp*

gives as a result:

-rw-r--r-- 1 root admin 1368 May 21 20:42 /private/var/log/wtmp
-rw-r--r-- 1 root admin 414 Apr 27 15:28 /private/var/log/wtmp.0.gz
-rw-r--r-- 1 root admin 219 Apr 1 13:42 /private/var/log/wtmp.1.gz
-rw-r--r-- 1 root admin 1913 Mar 6 14:44 /private/var/log/wtmp.2.gz

So, from my own user directory (usually /Users/your-name ) I just did a copy of all this files into the Documents folder, just to be safe and juggle with them in a safe place.
Like this:

cp /private/var/log/wtmp.* Documents/

Then, getting into Documents/

cd Documents

and GUNZIPping those WTMPs

gunzip wtmp.*

At last, LASTing each of the four WTMPs, I found the info I needed into wtmp.2:

last -f wtmp.2|more

revealed what follows:

steve ttyp2 Fri Feb 17 00:26 - shutdown (3+20:55)

There it is: I haven’t been rebooting since February 17th, that’s three months without a reboot!

Lesson learned include how much Mac OS X is robust… and as a result, how much LAST enables you to check all shutdown, crash and reboot of your Mac OS X box.
For a single system this may be a trivial task, but not for a multi-Mac sys admin having to cope with several distributed systems.