Yesterday, I was trying to debug why my server running Plex rebooted and wasn't able to figure it out. There are several new commands that I discovered, the best of which is called last.

This article was really useful.

who

who command prints which users are currently logged in:

$ who   
maxking  tty2         2020-04-30 22:17 (tty2)

But, you can use it with -b to figure out the last reboot time:

$ who -b       
         system boot  2020-04-30 22:16

last

last command prints a bunch of useful information, including

  • Time of last reboot, last reboot
  • time of last shutdown last shutdown
  • All the system restart/shutdown events and run level changes last -x

It also has a bunch of useful flags like, --present which also prints which users were present at the time (I really liked this one!)

$ last -p 14:40                                                                                                                                                                         1 ↵
maxking  tty2         tty2             Thu Apr 30 22:17   still logged in
reboot   system boot  5.6.7-300.fc32.x Thu Apr 30 22:16   still running

useful logs

I also found this stackexchange answer with a lot of useful log files that have information related to reboots like Kernel messages, systemd-journal etc.