uptime Command: Read Load Averages and Detect Server Anomalies

What is uptime?

The uptime command outputs four pieces of information: the current time, how long the system has been running since its last boot, the number of currently logged-in users, and the system load averages for the last 1, 5, and 15 minutes. While seemingly simple, these metrics carry significant security signal. An unexpected low uptime indicates a recent reboot — potentially caused by a kernel exploit, a rootkit installation requiring a reboot, or unauthorized server access. Load averages above the number of CPU cores during off-peak hours indicate sustained CPU saturation, which is the primary signature of cryptomining malware. The three load average values together also indicate trend direction: if the 1-minute average is much higher than the 15-minute average, load is increasing. If the reverse is true, an incident may be subsiding. For sysadmins, uptime is the fastest possible system health check — a single command that runs in milliseconds and provides immediate context before deeper investigation.

Syntax

uptime
uptime -p
uptime -s
cat /proc/uptime

The default uptime output is a single line. Use -p for human-readable uptime duration (e.g. ‘up 3 days, 4 hours’). Use -s to get the exact date and time the system was last booted — useful for correlating a suspected reboot with access logs. /proc/uptime provides the raw uptime in seconds for scripting.

Key Options and Flags

Common Use Cases

Detect Unexpected Reboots Indicating Unauthorized Access

A server that has been running for months should have a correspondingly high uptime value. A low uptime on a production server — especially one not scheduled for maintenance — is an immediate red flag. Use uptime -s to get the exact reboot time, then correlate with authentication logs to determine who had access or what ran at boot.

uptime -s
# Then check who logged in around that time:
last | head -20

Use Load Averages as an Early Cryptominer Warning

Cryptominers consume sustained CPU and produce load averages that remain persistently above the CPU core count, often without a clear legitimate explanation. Compare the 1-minute and 15-minute averages: a sustained elevation across all three intervals points to a persistent process, not a temporary spike. Follow up immediately with ps aux --sort=-%cpu | head -10 to identify the offending process.

uptime
# If load > CPU cores, immediately run:
ps aux --sort=-%cpu | head -10

Correlate Uptime with Cron Schedule to Detect Timed Attacks

Some malware executes on a schedule via cron, causing load spikes at predictable intervals. By monitoring uptime output over time and comparing spike timing against known cron schedules, you can detect scheduled malicious tasks before finding the crontab entry itself.

# Log load averages every minute to detect patterns
while true; do echo "$(date): $(uptime)"; sleep 60; done >> /var/log/load_monitor.log

Security Relevance: Load Averages as an Early DoS and Cryptominer Signal

Practical Examples

Check current load averages and compare against CPU core count

uptime && nproc

Running uptime immediately followed by nproc gives you the load averages and the number of CPU cores in two lines. If any load average exceeds the core count, the system is saturated.

Get the exact boot time to anchor a reboot investigation

uptime -s

Outputs the date and time of the last system boot in YYYY-MM-DD HH:MM:SS format. Use this timestamp to query auth logs, syslog, and kernel logs for events at and immediately after the reboot.

Log load averages continuously to detect timed attack patterns

while true; do echo "$(date '+%Y-%m-%d %H:%M:%S'): $(uptime)"; sleep 60; done >> /var/log/load_monitor.log

Creates a rolling log of load averages with timestamps. Running this in a screen or tmux session during an investigation reveals whether high load is continuous or periodic, which distinguishes a background process from a scheduled task.

Troubleshooting Common Issues

Summary

The uptime command is the fastest possible system health check — one line of output that contains immediate security signal. Load averages above the CPU core count indicate saturation that warrants investigation. An unexpectedly low uptime indicates an unplanned reboot that should be treated as a security event. Use uptime -s to anchor any reboot investigation with an exact timestamp.

• Compare load averages against nproc output — sustained load above core count during off-peak hours is the cryptominer signature
• Run uptime -s immediately when investigating an unexpected reboot to get the exact timestamp for log correlation
• Periodic load spikes at consistent intervals suggest a cron-based malicious task — log load averages over time to identify the pattern