A change of the run level is recorded as a type 1 (RUN_LVL) record in /etc/utmp and /var/adm/wtmp. With “who -r” the time of the last run level change and the current run level can be determined:
$ who -r
. run-level 2 Jan 15 11:56 2 0 S
$
If you want to know when past run level changes have been, the file /var/adm/wtmp can be used together with “who -r“:
$ who -r /var/adm/wtmp
. run-level 2 Jan 15 09:30 2 0 S
. run-level 2 Jan 15 11:56 2 0 S
. run-level S Jan 15 12:23 S 1 2
. run-level 2 Jan 15 12:24 2 1 S
$