See computer's uptime and history

Question

I was wondering if it is at all possible to find out when the computer was switched on, what files where accessed what folders were opened, what programs run and when the computer was resumed and put back to sleep (just like in the movies).

I know this isn't that important but it would be cool to know.

9

I object: this is important. – Agos Jun 27 '11 at 22:50

score 68 · Accepted Answer · edited Jun 28 '11 at 16:43

When was the machine turned on:

uptime

Example from my notebook:

20:06:33 up  1:50,  2 users,  load average: 0.03, 0.04, 0.05

That is current time, uptime, amount of users and the load average.

What programs run:

Command line
```
ps -ef|more
```
GUI - System monitor (dash, system monitor):

When the computer was resumed or sleep

last

enter image description here

what folders were opened

what files where accessed

None of these I know a command for. Natty has activity journal for files.

Other interesting things...

To see when the users logged in the last time: lastlog.
Login failure: faillog.

last, lastlog, faillog make use of log file /var/log/wtmp (last), /var/log/lastlog and /var/log/faillog. If those are not active you will not get any result.
lsof shows a list of currently open files.

It can do alot of checks on a lot of options. From man lsof:
To list all open IPv4 network files in use by the process whose PID is 1234, use:
```
lsof -i 4 -a -p 1234
```
To list all open files for login name ``abe'', or user ID 1234, or process 456, or process 123, or process 789, use:
```
lsof -p 456,123,789 -u 1234,abe
```
To list all open files on device /dev/hd4, use:
```
lsof /dev/hd4
```

To see when the users logged in the last time, use lastlog. For login failures, use faillog. Note that these programs (including last) make use of log files, notably: /var/log/wtmp (last), /var/log/lastlog (lastlog) and /var/log/faillog (faillog). — Lekensteyn, Jun 27 '11 at 19:01

score 18 · Answer 2 · answered Jun 27 '11 at 18:10

18

You can use the last command to check on boot times, reboots, suspends/resumes.

answered Jun 27 '11 at 18:10

htorque

64,798

3

...and even crashes: "user pts/4 :0 Mon Jun 6 15:13 - crash (1+17:30)" – Lekensteyn Jun 27 '11 at 19:12

score 5 · Answer 3 · answered Jun 27 '11 at 18:13

5

A few things worth checking out :

uptime command to see how long your computer's been running.
Gnome Log Viewer (gnome-system-log) shows all of your logs at one place.
Zeitgeist Activity Journal. This gives a brilliant calendar like view to show you what files were opened, and which applications were used.

answered Jun 27 '11 at 18:13

Nemo

9,460

a video of zeitgeist in action looks preety good. http://www.youtube.com/watch?v=g1D95YR3aVE – Vitaly Jun 27 '11 at 19:24
1

sudo apt-get install zeitgeist sudo apt-get install gnome-activity-journal – Vitaly Jun 27 '11 at 19:26

score 5 · Answer 4 · answered Jun 27 '11 at 18:25

As many have said "uptime" gives you up time.

I like to use "htop" to show me information about what's currently running - it's really really nicely formatted, easy for me to skim.

If you want to see who's currently logged in, try the command "who". You can dump messages on to their terminals by the "write" command, that can be fun.

As for seeing what's been going on, you can check your logs, such as /var/log/syslog or /var/log/messages (depending on distro). Further, for somewhat lower-level messages, "dmesg" is helpful.

Another thing you can use to try to see history is take a look at users *~/.bash_history* (or ~/.history, etc). That file will show you a list of commands that user has recently run. I believe a user has the ability to nuke their own history file. There's probably ways of configuring that so you can monitor more closely.

Hope that helps.

Binarylife · Answer 5 · 2011-06-27T18:25:58.383

2

In the terminal write :

uptime

edited Jun 27 '11 at 18:25

answered Jun 27 '11 at 18:07

Binarylife

16,442

2

What about machines that stay up for days? – Marco Ceppi Jun 27 '11 at 18:18
2

days!? how about years? :-D – Rinzwind Jun 27 '11 at 18:21
lol ...my bad :D! – Binarylife Jun 27 '11 at 18:25
@MarcoCeppi: from my machine: "20:55:04 up 8 days, 17:29, 18 users, load average: 1.89, 1.85, 1.90". This is not a server, I just put it in suspend. Those "18 users" refer to terminals, I'm the only user of the system =] There is no such thing as "up 2 years", it'll show something like "up 756 days". @binarylife: If you want to parse it, be sure to look in the source code of uptime to prevent making mistakes – Lekensteyn Jun 27 '11 at 18:57
1

@Lekensteyn I'm aware of how days are counted. Oldest server up is 834 days :) Was just pointing it out to @binarylife that there are also days included in uptime count – Marco Ceppi Jun 27 '11 at 19:07
@Lekensteyn: Yes I should have seen the source code.The thing that I'm still learning and improving these mistakes. @Marco Ceppi : are you talking about the second command that I deleted ? or just about uptime ? – Binarylife Jun 27 '11 at 19:46
@binarylife: @MarcoCeppi was talking about your command – Lekensteyn Jun 27 '11 at 19:47
@Lekensteyn : I see, alright:) – Binarylife Jun 27 '11 at 19:51

score 2 · Answer 6 · answered Jun 27 '11 at 18:29

2

For a graphical solution, System Profiler and Benchmark (search in the Ubuntu Software Center) provides both uptime and lists all starts. I don't know if it shows the programs that were run, although I guess I doubt it. But the program is very good for getting all sorts of information about your system, mostly hardware-related.

answered Jun 27 '11 at 18:29

Kelley

33,062

nice the app is preety slick thnx – Vitaly Jun 27 '11 at 19:15
I installed the app, but what next? – Line Jul 13 '23 at 22:46

score 1 · Answer 7 · answered Jun 27 '11 at 18:08

1

To check the uptime of a PC go to Terminal and type uptime then press enter.

answered Jun 27 '11 at 18:08

scouser73

4,334

score 0 · Answer 8 · answered Apr 28 '21 at 15:46

0

screenfetch also works for this and provides data in a nice way.

Install it with $ sudo apt install screenfetch.

Then type screenfetch for the information.

(Note: It only shows how many hours it was turned on and other details of the system)

answered Apr 28 '21 at 15:46

Assasin_on_fire

11