Note: This is only a partial answer, dealing only with the difference between uptime and suspended time.
You could determine the difference between uptime and suspended time utilizing some of the information available via /proc/timer_list
.
Example 1:
$ uptime
11:58:46 up 3:43, 2 users, load average: 0.00, 0.01, 0.05
$ cat /proc/timer_list | grep "now at"
now at 12734872068331 nsecs
So uptime = (3 * 60 + 43) * 60 = 13,3800 seconds.
Active time = 12,735 seconds.
Therefore Suspended time = 13,300 - 12,735 = 645 seconds
Or, just look at the offset time for each CPU to get its suspended time directly:
$ cat /proc/timer_list | grep -A 1 "ktime_get_boottime"
.get_time: ktime_get_boottime
.offset: 668016000993 nsecs
--
.get_time: ktime_get_boottime
.offset: 668016000993 nsecs
--
.get_time: ktime_get_boottime
.offset: 668016000993 nsecs
--
.get_time: ktime_get_boottime
.offset: 668016000993 nsecs
--
.get_time: ktime_get_boottime
.offset: 668016000993 nsecs
--
.get_time: ktime_get_boottime
.offset: 668016000993 nsecs
--
.get_time: ktime_get_boottime
.offset: 668016000993 nsecs
--
.get_time: ktime_get_boottime
.offset: 668016000993 nsecs
Or 668 seconds for each CPU.
Why do the two methods differ by 23 seconds? Because uptime is only listed to the minute. So that answer is really 645 +59 -0 seconds (or, depending if uptime rounds, 645 +- 30 seconds.
So for what you seem to want run this during shutdown:
$ cat /proc/timer_list | grep "now at"
now at 25561396304263 nsecs
and divide that number by 3.6e12 (i.e. 7.1 hours active time)
last -x
command... something like that? – JoKeR Jul 11 '15 at 19:23