topic Re: last login cmd in Operating System - HP-UX

last login cmd

Peter Gillis — Tue, 05 Oct 2004 18:43:06 GMT

HI, ux11.11 v1.
I have noticed when I issued the cmd `last -5 -R $LOGNAME` the user was listed as still logged in on pts/tL; but If I do `ps -ef|grep pts/tL`, then that tty is now listed as being used another user. Can some one explain why this is happening. Why is the last command still showing the original user as logged in on that particular device. This is still the situation if I kill the process for that device with the original user.?
Thanks in advance for explanations
Maria

Re: last login cmd

Sundar_7 — Tue, 05 Oct 2004 18:55:26 GMT

I think you got to live with it Maria. :-)

It happens when the /var/adm/wtmp file is not properly updated. It happens for various reasons.

But,if you would still like to make those "cosmetic" changes to the last output, then you can manually edit and modify the entries

wtmp is a binary file. So you need to use /usr/sbin/acct/fwtmp to make changes.

1) use fwtmp command to create the ascii version of wtmp file.
2) Edit the ascii file and make changes
3) Convert the ascii file back to the wtmp format using fwtmp command.

- Sundar

Re: last login cmd

Bill Hassell — Tue, 05 Oct 2004 19:12:38 GMT

last depends on a sane list of actions in wtmp. The problem is that users don't always do nice things with their computers (well, sometimes their non-Unix computers decide to reboot) leaving orphaned connections). There are also some programming errors that can leave wtmp with missing stop records. last does not look at ps, it looks at wtmp and matches login/logout records.

Re: last login cmd

Peter Gillis — Tue, 05 Oct 2004 20:16:42 GMT

Thanks Sundar and Bill.