last login cmd

[Peter Gillis]

HI, ux11.11 v1.
I have noticed when I issued the cmd `last -5 -R $LOGNAME` the user was listed as still logged in on pts/tL; but If I do `ps -ef|grep pts/tL`, then that tty is now listed as being used another user. Can some one explain why this is happening. Why is the last command still showing the original user as logged in on that particular device. This is still the situation if I kill the process for that device with the original user.?
Thanks in advance for explanations
Maria

[Sundar_7 · Accepted solution]

I think you got to live with it Maria. :-)

It happens when the /var/adm/wtmp file is not properly updated. It happens for various reasons.

But,if you would still like to make those "cosmetic" changes to the last output, then you can manually edit and modify the entries

wtmp is a binary file. So you need to use /usr/sbin/acct/fwtmp to make changes.

1) use fwtmp command to create the ascii version of wtmp file.
2) Edit the ascii file and make changes
3) Convert the ascii file back to the wtmp format using fwtmp command.

- Sundar

[Bill Hassell]

last depends on a sane list of actions in wtmp. The problem is that users don't always do nice things with their computers (well, sometimes their non-Unix computers decide to reboot) leaving orphaned connections). There are also some programming errors that can leave wtmp with missing stop records. last does not look at ps, it looks at wtmp and matches login/logout records.

[Peter Gillis]

Thanks Sundar and Bill.