判斷伺服器最後一次啟動是熱啟動還是冷啟動

last -x  顯示系統關機，重新開機，以及執行等級的改變等資訊。

下面是執行關機和重啟之後執行last -x的結果:
root pts/0 192.168.0.120 Fri Dec 21 14:15 still logged in
root tty1 Fri Dec 21 14:02 still logged in
runlevel (to lvl 3) 2.4.20-8 Fri Dec 21 13:59 – 14:15 (00:15)
reboot system boot 2.4.20-8 Fri Dec 21 13:59 (00:15)
shutdown system down 2.4.20-8 Fri Dec 21 13:59 – 14:15 (00:16)
runlevel (to lvl 6) 2.4.20-8 Fri Dec 21 13:58 – 13:59 (00:00)
root tty1 Fri Dec 21 13:58 – down (00:00)
runlevel (to lvl 3) 2.4.20-8 Fri Dec 21 13:57 – 13:58 (00:01)
reboot system boot 2.4.20-8 Fri Dec 21 13:57 (00:01)
shutdown system down 2.4.20-8 Fri Aug 9 16:19 – 13:58 (-231+-2:-20
runlevel (to lvl 0) 2.4.20-8 Fri Aug 9 16:18 – 16:19 (00:00)

wtmp begins Fri Aug 9 16:18:42 2002

執行級別0代表關機,6代表重啟
1、執行關機命令時首先會記錄改變執行級別到0,然後記錄關機
shutdown system down 2.4.20-8 Fri Aug 9 16:19 – 13:58 (-231+-2:-20
runlevel (to lvl 0) 2.4.20-8 Fri Aug 9 16:18 – 16:19 (00:00)
2、（熱啟）執行重啟命令時首先會記錄改變執行級別到6,再記錄關機,然後記錄啟動,最後記錄改變執行級別為當前啟動級別3
runlevel (to lvl 3) 2.4.20-8 Fri Dec 21 13:59 – 14:15 (00:15)
reboot system boot 2.4.20-8 Fri Dec 21 13:59 (00:15)
shutdown system down 2.4.20-8 Fri Dec 21 13:59 – 14:15 (00:16)
runlevel (to lvl 6) 2.4.20-8 Fri Dec 21 13:58 – 13:59 (00:00)
3、（冷啟）如果系統是冷啟動則首先記錄啟動,然後記錄改變執行級別為當前啟動級別3
runlevel (to lvl 3) 2.4.20-8 Fri Dec 21 13:57 – 13:58 (00:01)
reboot system boot 2.4.20-8 Fri Dec 21 13:57 (00:01)

====>
熱啟動:
runlevel (to lvl 3) 或 runlevel (to lvl 5)
reboot system boot
shutdown system down
runlevel (to lvl 6)
冷啟動:
runlevel (to lvl 3) 或 runlevel (to lvl 5)
reboot system boot

因此區別冷啟動還是熱啟動,可以獲得last -x的輸出後,
判斷reboot system boot 之後的第二行是runlevel (to lvl 6) 開頭則是熱啟動,否則是冷啟動