List system events with last:
$ last -xF
leo tty1 Tue Jul 30 09:47:44 2019 still logged in
runlevel (to lvl 5) 4.15.0-51-generi Tue Jul 30 09:47:22 2019 still running
reboot system boot 4.15.0-51-generi Tue Jul 30 09:46:47 2019 still running
shutdown system down 4.15.0-51-generi Tue Jul 30 09:15:20 2019 - Tue Jul 30 09:46:47 2019 (00:31)
reboot system boot 4.15.0-51-generi Tue Jul 30 09:13:55 2019 - Tue Jul 30 09:15:20 2019 (00:01)
leo tty1 Mon Jul 29 15:01:14 2019 - crash (18:12)
runlevel (to lvl 5) 4.15.0-51-generi Mon Jul 29 15:01:13 2019 - Tue Jul 30 09:15:20 2019 (18:14)
reboot system boot 4.15.0-51-generi Mon Jul 29 15:00:36 2019 - Tue Jul 30 09:15:20 2019 (18:14)
leo pts/8 tmux(4610).%3 Sun Jul 28 12:26:53 2019 - Sun Jul 28 13:18:59 2019 (00:52)
The last column of the output is the duration of the event, with format 'HH:MM'.
For example, the 4th line of above output shows during 9:15 to 9:46, the status of the system is shutdown, which means the machine is powered off during the 31 minutes.
The 5th line shows the reboot event lasted for 1 minute from 09:13:55 to 09:15:20.
This command can't provide information about abnormal shutdown (or crash). For example, we can see the system is booted at 2019.7.29 15:00:36, and reboot at 2019.7.30 09:13:55. There was a power failure in the office in the night of 2019.7.29. But from the logs, there's only a crash log (the 7th line of above code snippet), which means the user leo is logged in at 2019.7.29 15:01:14, but there isn't the corresponding logout message in database wtmp (stored in binary file /var/log/wtmp).
Ref: