Board index Linux Setup

'last' command off by one

'last' command off by one

Post by Jeff Templ » Sat, 20 May 1995 04:00:00



Linux 1.2 Slackware.  Problem: entries given by 'last' command
are off by one.  Example: I truncate the wtmp file (cat > wtmp)
and reboot.  Sessions at the console are logged correctly with
correct login and logout times, but if I start X (using startx
command) then I don't see any ttypx entries for xterms.  If
I log an xterm out, then an entry shows up under 'last', with
the actual logout time given as the reported login time, and
saying that I am "still logged in"

Here are some excerpts, first from finger, then from last.
ttyp2 shown under last is an xterm which I started after
starting X (used a menu item to do so), and then logged out of
it a minute later.  Note that I start xterm with the +ut option.

:: bash# finger
:: Login    Name                 Tty  Idle  Login Time   Office     Office Ph
:: templon  Jeff Templon          1     21  May 19 12:49 26-452     8-5442
:: templon  Jeff Templon          p1        May 19 12:49 [ :0.0 ]
:: templon  Jeff Templon          p0    16  May 19 12:49 [ :0.0 ]
:: bash# last -4
:: templon   ttyp2        :0.0             Fri May 19 12:50   still logged in
:: templon   tty1                          Fri May 19 12:49   still logged in
:: templon   tty1                          Fri May 19 12:47 - 12:48  (00:01)
:: runlevel  ~                             Fri May 19 12:46

Any suggestions welcome.

                                                JT

 
 
 
Top

1. 'last' command doesn't show complete login times

Hello,
I am trying to use the information from the "last" command to examine
how long users are logged into a certain machine for a research
project.  I wrote a perl script to parse the information into a comma
delimited file, opened it in a spreadsheet, and sorted the entries by
how long the users were logged in.  To my surprise, out of about 3200
entries, only 17 of them showed up as being logged in for more than an
hour!  I know this information is inaccurate, because these users work
on projects for hours at a time.  Another mystery is that when I run
"who", it shows about 50 users being logged in, whereas the "last"
command only shows about 10.  Running last using utmpx as the file
instead of the default wtmpx, it shows users being logged in for a lot
longer. (???)

I know that the "who" command uses the utmpx file, and the "last"
command uses the wtmpx file, but shouldn't the wtmpx file contain the
same information as the utmpx file, only a lot more of it?  Can anyone
think of an explanation to why the "last" output isn't showing the
entire session a user is logged in for?  Also, if there is data
missing, is there another way I can get the login and logout history
of all the users?

I would greatly appreciate any help you can give. :)

Thanks,
Julie

2. Network disaster-help

3. Sun's 'last' command

4. Opera

5. The 'last' command doesn't record users logout

6. x-window configuration

7. Help: problems with 'w', 'who' and 'last'

8. chroot in ftp

9. setup one interface for 'up' and another one for 'down'

10. the 'last' command

11. 'last' command 8 character username limit

12. Why has my 'last' command suddenly stopped working?

13. 'last' command anomaly


All times are UTC
Board index