Linux provides a utility called runlevel but "who -r" is a portable solution which is available across various Unix types. Here is a brief explanation for both commands. This information is extracted from utmp file.
On Linux "who -r" provides the current run level and when it went in effect [citation needed] and the last run level (if available). Similarly runlevel provides previous and current runlevels separated by a space. If there is no previous runlevel then “N” is reported otherwise a number indicating previous runlevel is reported. Below example shows how the output will look with no previous run level and what it will look like with a previous run level. Redhat has similar output but the time format would be different.
sandboxL:~> who -r
run-level 2 2010-07-21 11:01
sandboxL:~> runlevel
N 5
sandboxL:~> su -
sandboxL:#> init 5
sandboxL:#> init 2
sandboxL:#> who -r
run-level 2 2010-07-21 21:04 last=5
sandboxL:#> runlevel
5 2
sandboxL:#>
On Solaris number after “run-level” is current run level. This is also displayed after the timestamp. Right after that (below 0) is “Number of times at this run level since last reboot”. And final digit (below S) is “Previous run level”.
sandboxS:~> who -r . run-level 3 Jun 21 18:45 3 0 S sandboxS:~>
OS Interoperability
Solaris does not have runlevel command but a code base is available over internet to provide this information. But safer bet will be to use "who -r" which is available on most frequently used Unixes.
