How to See Previous Boot Times: A Complete Guide

Updated on August 4, 2025, by ITarian

Have you ever wondered how to see previous boot times on your systems to analyze startup behavior, detect anomalies, or assess performance issues? Whether you’re an IT manager tracking uptime, a cybersecurity expert looking for irregular reboots, or a CEO overseeing infrastructure health, boot time analysis can be a valuable diagnostic tool.

Knowing how long it takes for a system to start—and when it started—helps in performance tuning, threat investigation, and uptime monitoring.

This comprehensive guide will walk you through step-by-step methods to view previous boot times on both Windows and Linux, using native tools and commands—no third-party software required.

Why Boot Time Monitoring Matters

Understanding previous boot times isn’t just about startup speed—it’s about system reliability, cybersecurity, and IT compliance.

Here’s why tracking boot times is crucial:

• Detect unexpected reboots that may indicate malware activity

• Measure startup performance to detect degradation

• Audit system usage and uptime across enterprise machines

• Verify patch schedules or updates that required restarts

• Investigate failed boot sequences or BSOD events

If your goal is system stability and visibility, learning how to see previous boot times should be part of your toolkit.

How to See Previous Boot Times in Windows

Windows provides several tools and commands to check when your system was last started, how long it took to boot, and a history of shutdown and restart events.

Method 1: Use Windows Event Viewer

Event Viewer is your go-to tool for deep system logs.

Steps:

1. Press Win + R, type eventvwr, and hit Enter

2. Navigate to:
   Windows Logs > System

3. Click Filter Current Log on the right pane

4. In the Event IDs field, enter:
   • 6005 – Event log service started (system boot)

   • 6006 – Event log service stopped (shutdown)

   • 6009 – Processor info during boot

   • 6013 – System uptime

5. Click OK and scroll to view previous boot times

📌 These logs provide timestamped boot/shutdown entries, useful for forensics or uptime audits.

Method 2: Using Command Prompt or PowerShell

You can use the systeminfo command in CMD or PowerShell.

bash

CopyEdit

systeminfo | find “System Boot Time”

It returns the last boot-up time. To view the system’s uptime, use:

bash

CopyEdit

net statistics workstation

Look for:
Statistics since [date/time] — this shows when the workstation service started (usually system boot).

💡 Ideal for scripts or remote session checks.

Method 3: Use PowerShell with WMI or CIM

To retrieve the last boot time using WMI:

powershell

CopyEdit

(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

Or using WMI:

powershell

CopyEdit

(Get-WmiObject -Class Win32_OperatingSystem).LastBootUpTime

Want the boot time in human-readable format?

powershell

CopyEdit

((Get-CimInstance Win32_OperatingSystem).LastBootUpTime).ToLocalTime()

🔐 This method is handy for integrating boot time checks in endpoint monitoring scripts.

Method 4: Use Windows Reliability Monitor

Reliability Monitor offers a graphical timeline of system events.

Steps:

1. Search for “Reliability Monitor” in the Start menu

2. Open it and look for red Xs or Restart icons

3. Hover over each to view shutdown/startup history

How to See Previous Boot Times in Linux

Linux offers powerful command-line utilities to check current uptime and a full list of previous boots.

Method 1: Use who -b or uptime

The simplest way to check the last boot time:

bash

CopyEdit

who -b

This shows the last system boot.

To check current uptime, use:

bash

CopyEdit

uptime

Example output:

text

CopyEdit

10:25:17 up 3 days, 4:15, 2 users, load average: 0.05, 0.01, 0.00

Method 2: Use the last Command

last reads from /var/log/wtmp to show the login and reboot history.

bash

CopyEdit

last reboot

You’ll see a list of previous boot sessions:

text

CopyEdit

reboot   system boot  5.15.0-84-generic Mon Aug  5 10:22   still running

reboot   system boot  5.15.0-84-generic Sun Aug  4 09:15   still running

Each line shows the boot time and duration.

✅ This is ideal for log audits, uptime checks, and security monitoring.

Method 3: Use journalctl (for systemd-based distros)

bash

CopyEdit

journalctl –list-boots

This shows a list of previous boots indexed by number. To view logs from a specific boot:

bash

CopyEdit

journalctl -b -1

The -1 refers to the previous boot (-2 is the one before that, and so on).

To view the boot time only:

bash

CopyEdit

journalctl –boot -1 | grep “systemd[1]: Started”

🔍 Use this to detect failed boots or long startup processes.

Method 4: Analyze Boot Duration with systemd-analyze

Want to see how long your system took to boot?

bash

CopyEdit

systemd-analyze

Example output:

text

CopyEdit

Startup finished in 3.222s (kernel) + 1.452s (userspace) = 4.674s

To break it down by services:

bash

CopyEdit

systemd-analyze blame

This shows which services delayed the boot process.

🚀 Essential for performance optimization and reducing startup bloat.

Compare Boot Time Across Platforms

Use Cases for Cybersecurity & IT Teams

Understanding how to see previous boot times supports a variety of operations:

1. Incident Response

• Identify unauthorized reboots

• Cross-reference reboots with login or intrusion attempts

2. Patch Management

• Verify if devices rebooted after patch schedules

• Check consistency across fleet devices

3. Uptime Monitoring

• Ensure compliance with SLAs

• Detect frequent restarts indicating hardware or driver issues

4. Performance Analysis

• Audit boot times to assess resource bottlenecks

• Troubleshoot slow startups

Expert Tips for Managing Boot Logs

• Use PowerShell scripts to query multiple endpoints

• Automate journalctl reports with cron on Linux

• Regularly export Windows Event Logs for long-term storage

• Use centralized logging tools (e.g., Graylog, Splunk, ELK)

Frequently Asked Questions (FAQ)

1. How can I find out when my computer was last rebooted?

• On Windows: systeminfo | find “System Boot Time”

• On Linux: who -b or last reboot

2. Can I see a history of all previous reboots?

Yes, on Linux, last reboot gives you a full list. On Windows, use Event Viewer filtered by Event ID 6005 and 6006.

3. How can I check how long my system takes to boot?

• Linux: systemd-analyze

• Windows: Use Performance Monitor or BootPerformanceMonitoring registry keys (advanced).

4. Can I detect abnormal reboots or crashes through boot times?

Yes. Frequent or unscheduled reboots visible in logs may indicate malware, hardware failure, or misconfigured updates.

5. Do VMs and servers support the same boot time tracking?

Yes. All major virtualization platforms preserve boot logs. For enterprise environments, use monitoring agents to track them centrally.

Final Thoughts

Knowing how to see previous boot times is a core skill for anyone managing IT environments or investigating system health. Whether you’re reviewing uptime, tuning performance, or responding to incidents, these methods offer deep insight into system behavior.

👉 Ready to automate and secure your IT infrastructure with better visibility?

Start your FREE Itarian trial today and gain access to powerful tools for monitoring, patching, remote access, and endpoint security—all in one place.