Is there some way to fix this difference?
First of all, check your system time, both at the hardware and the system level. Do you run some ntp client? Then your system will start with its time set to the values from the hardware clock and then “jump” upon receiving ntp results. If that is not written back to the hardware clock, try to fix that.
Secondly, “who -b” accesses /var/run/utmp, while “last” uses /var/log/wtmp. Both files have the same general format, so you can take a peek at them using
[CODE]# last -f /var/log/wtmp
last -f /var/run/utmp
wtmp is the file considered more appropriate.
On my system /var/run/utmp is cleared upon reboot, so “who -b” reports the same as does “last reboot”. But using the info above, you should be able to track down why this is handled differently on your system. If you need assistance along the way, just let us know your questions together with some “cut&paste"s of the corresponding system commands and we’ll try to get this issue resolved. Start with details on the OS version, which Mike has already asked for (”$ cat /etc/release").
at first,thank you for your help.
suse:~ # cat /etc/issue
Welcome to SUSE Linux Enterprise Server 11 SP3 (x86_64) - Kernel \r (\l).
some one told me that this will be ok after next reboot.