last -x 显示系统关机，重新开机，以及执行等级的改变等信息。
下面是执行关机和重启之后执行last -x的结果:
root pts/0 192.168.0.120 Fri Dec 21 14:15 still logged in
root tty1 Fri Dec 21 14:02 still logged in
runlevel (to lvl 3) 2.4.20-8 Fri Dec 21 13:59 – 14:15 (00:15)
reboot system boot 2.4.20-8 Fri Dec 21 13:59 (00:15)
shutdown system down 2.4.20-8 Fri Dec 21 13:59 – 14:15 (00:16)
runlevel (to lvl 6) 2.4.20-8 Fri Dec 21 13:58 – 13:59 (00:00)
root tty1 Fri Dec 21 13:58 – down (00:00)
runlevel (to lvl 3) 2.4.20-8 Fri Dec 21 13:57 – 13:58 (00:01)
reboot system boot 2.4.20-8 Fri Dec 21 13:57 (00:01)
shutdown system down 2.4.20-8 Fri Aug 9 16:19 – 13:58 (-231+-2:-20
runlevel (to lvl 0) 2.4.20-8 Fri Aug 9 16:18 – 16:19 (00:00)
wtmp begins Fri Aug 9 16:18:42 2002
运行级别0代表关机,6代表重启
1、执行关机命令时首先会记录改变运行级别到0,然后记录关机
shutdown system down 2.4.20-8 Fri Aug 9 16:19 – 13:58 (-231+-2:-20
runlevel (to lvl 0) 2.4.20-8 Fri Aug 9 16:18 – 16:19 (00:00)
2、（热启）执行重启命令时首先会记录改变运行级别到6,再记录关机,然后记录启动,最后记录改变运行级别为当前启动级别3
runlevel (to lvl 3) 2.4.20-8 Fri Dec 21 13:59 – 14:15 (00:15)
reboot system boot 2.4.20-8 Fri Dec 21 13:59 (00:15)
shutdown system down 2.4.20-8 Fri Dec 21 13:59 – 14:15 (00:16)
runlevel (to lvl 6) 2.4.20-8 Fri Dec 21 13:58 – 13:59 (00:00)
3、（冷启）如果系统是冷启动则首先记录启动,然后记录改变运行级别为当前启动级别3
runlevel (to lvl 3) 2.4.20-8 Fri Dec 21 13:57 – 13:58 (00:01)
reboot system boot 2.4.20-8 Fri Dec 21 13:57 (00:01)
====>
热启动:
runlevel (to lvl 3) 或 runlevel (to lvl 5)
reboot system boot
shutdown system down
runlevel (to lvl 6)
冷启动:
runlevel (to lvl 3) 或 runlevel (to lvl 5)
reboot system boot
因此区别冷启动还是热启动,可以获得last -x的输出后,
判断reboot system boot 之后的第二行是runlevel (to lvl 6) 开头则是热启动,否则是冷启动
