radwtmp

[Alan DeKok]

David WU wrote:
> 
> I found that the first character of login in the logout record of each
> login/logout pair missing,

  login/logout pair?  "radwtmp" stores the list of users currently
logged in.  So when a user logs out, the first character of their name
is set to zero.  This indicates that they are no longer logged on.  See
"man wtmp"

  The wtmp file records all logins and logouts.  Its format is exactly
  like  utmp except that a null user name indicates a logout on the
  associated terminal.

> The native 'last' command operated on radwtmp with normal results, so I
> suspect 'last' uses as index the host field instead of the name field.

  I don't understand what you think are "normal" results here.  The
"radlast" program is simply a 3-line shell script wrapper around the
native "last" command.

  Maybe you're thinking of the radutmp file?

  Alan DeKok.