[Linux 常見問題] Linux Find Out Last System Reboot Time and Date Command

Source From Here 
Question 
So, how do you find out my Linux or UNIX-like system was last rebooted or display shutdown date and time? The last utility will either list the sessions of specified users, ttys, and hosts, in reverse time order, or list the users logged in at a specified date and time. Each line of output contains the user name, the tty from which the session was conducted, any hostname, the start and stop times for the session, and the duration of the session. To view Linux or Unix system reboot and shutdown date and time stamp use the following commands: 

* last command: Show listing of the most recently logged in users.
* who command: Displays who is logged on to the system.

HowTo 

who command 
You need to use the who command, to print who is logged on. It also displays the time of last system boot. Use the last command to display system reboot and shutdown date and time, run: 

// -b, --boot: time of last system boot
# who -b
system boot 2016-01-05 04:00

Use the last command to display listing of last logged in users and system last reboot time and date, enter: 

# last reboot
reboot system boot 3.10.0-229.20.1. Tue Jan 5 04:00 - 23:58 (79+18:58)
reboot system boot 3.10.0-229.20.1. Wed Dec 9 20:14 - 03:59 (26+07:45)
reboot system boot 3.10.0-229.20.1. Wed Dec 9 20:11 - 20:14 (00:02)
reboot system boot 3.10.0-229.20.1. Wed Dec 2 00:22 - 20:11 (7+19:48)
reboot system boot 3.10.0-229.el7.x Tue Dec 1 03:16 - 20:11 (8+16:55)

wtmp begins Tue Dec 1 03:16:33 2015
# last reboot | head -1
reboot system boot 3.10.0-229.20.1. Tue Jan 5 04:00 - 23:59 (79+18:58)

The last command searches back through the file /var/log/wtmp and displays a list of all users logged in (and out) since that file was created. The pseudo user reboot logs in each time the system is rebooted. Thus last reboot command will show a log of all reboots since the log file was created. 

Finding systems last shutdown date and time 

// -x: Display the system shutdown entries and run level changes.
# last -x | grep shutdown
shutdown system down 3.10.0-229.20.1. Tue Jan 5 03:59 - 04:00 (00:01)
shutdown system down 3.10.0-229.20.1. Wed Dec 9 20:14 - 20:14 (00:00)
shutdown system down 3.10.0-229.20.1. Wed Dec 9 20:11 - 20:11 (00:00)
# last -x | grep shutdown | head -1
shutdown system down 3.10.0-229.20.1. Tue Jan 5 03:59 - 04:00 (00:01)

How do I find who rebooted/shutdown the Linux box? 
You need to enable psacct service and run the following command to see info about executed commands including user name. Type the following lastcomm command to see 

# lastcomm userNameHere
# lastcomm commandNameHere
# lastcomm | more
# lastcomm reboot
# lastcomm shutdown
// OR see both reboot and shutdown time
# lastcomm | egrep 'reboot|shutdown'

Sample outputs: 

reboot S X root pts/0 0.00 secs Sun Dec 27 23:49
shutdown S root pts/1 0.00 secs Sun Dec 27 23:45

So root user rebooted the box from ‘pts/0’ on Sun, Dec, 27th at 23:49 local time.