On Sun, 9 Mar 2008, Alan DeKok wrote:
David WU wrote:
I found that the first character of login in the logout record of each login/logout pair missing,
login/logout pair? "radwtmp" stores the list of users currently logged in. So when a user logs out, the first character of their name
Actually I think it stores historical records of users logging in and logging out.
is set to zero. This indicates that they are no longer logged on. See "man wtmp"
The wtmp file records all logins and logouts. Its format is exactly like utmp except that a null user name indicates a logout on the associated terminal.
I did "man wtmp" on the newest release of FreeBSD and the ancient BSD/OS and neither mention the null user name aspect (I think other BSD variants behave similarly), but you are quite correct about the wtmp null user name on the Mandrake release 10.0 and I suspect all linux releases.
The native 'last' command operated on radwtmp with normal results, so I suspect 'last' uses as index the host field instead of the name field.
I don't understand what you think are "normal" results here. The "radlast" program is simply a 3-line shell script wrapper around the native "last" command.
Just found this out about the radlast doing "man radlast". I guess my "normal" results come from a BSD perspective. Best David