The Last Command

[Paul Romanek]

when I run the last and lastb command the second Column looks like this

pts/tb

My question is what does the tb stand for also the tb will vary from te,tg,tc,tj,tf,t1,ti and 0. Can anybody explain this to me. And can i use this to figure out where people are logging in from.

[Mark Fenton]

The 'tb' from pts/tb is the designator of the pseudo-terminal the user logged on to.

Whenever someone logs on to the UNIX system, the system assigns a terminal or pseudo terminal depending on the connection type. How many terminals are available in the pool to use depends on your particular installation, and is configurable by the administrator. Expanding the number of terminals available beyond the kernel's current limit requires a rebuild, but in general shouldn't be necessary for most installations.

# last mark |head -1
mark pts/16 Wed Jun 13 12:11 - 12:12 (00:01)

To take an example of the system I work on --
shows that user mark logged onto pseudo-terminal 16 (/dev/pts/16) on Wednesday Jun 13 from 12:11 - 12:12, a total of 1 minute.

cheers.

[Jim Turner]

Paul,

Like Mark explained, the "pts/tb" designation is just the pseudoterm identifier that was given to that network terminal session. You can use "who -Hu" to get some really useful information. Here is sample output from my C110:

# who -Hu
NAME LINE TIME IDLE PID COMMENTS
root console Apr 19 10:15 old 2016 system console
dcs0582 pts/1 Apr 23 09:29 old 22712 cannes.hertz.com
root ttyp1 Jun 11 15:03 . 770 172.16.141.40

You can see in the "COMMENTS" column the network source of each network terminal session. This may be more of what you are looking for. You can omit the "H" switch if you don't want the column headings (hint: scripted who -u collection via cron since who is a "real-time" command).

Cheers,
Jim

[Bill Hassell]

As mentioned, these are psuedo terminals and have nothing to do with where the users are located. Use the -R option to see that information as in:

last -R

or just for a user such as root:

last -R root

or to see the last 10 logins:

last -R -10 root

See also the same options for lastb which reports bad/failed login attempts.

[Jim Turner]

I bow to the brilliance of Mr. Hassell. He is correct as always (and when will *I* ever remember to RTFM?). Indeed I believe "last -R" is what you want to use.

Cheers,
Jim

[Paul Romanek]

Thank You all for the helpfull advise.

[Fred Martin_1]

Can I extend this thread with another question? Here's a fragment of output from "last -R" on my system:

xba ttyra fpc02
ajp pty/ttyt5 apc08
pjl ttyra dtcpor

I know where the first two users are physically located, the host names are PCs. But, the last entry is a dumb terminal on a 72-port DTC.

1. How do I tell where the dumb terminal is physically located?

2. What's the difference between a "tty" and a "pty/tty" ?

Fred