radwtmp

[David WU]

On Sun, 9 Mar 2008, Alan DeKok wrote:

> David WU wrote:
>>
>> I found that the first character of login in the logout record of each
>> login/logout pair missing,
>
>  login/logout pair?  "radwtmp" stores the list of users currently
> logged in.  So when a user logs out, the first character of their name

Actually I think it stores historical records of users logging in and 
logging out.

> is set to zero.  This indicates that they are no longer logged on.  See
> "man wtmp"
>
>  The wtmp file records all logins and logouts.  Its format is exactly
>  like  utmp except that a null user name indicates a logout on the
>  associated terminal.

I did "man wtmp" on the newest release of FreeBSD and the ancient BSD/OS 
and neither mention the null user name aspect (I think other BSD variants 
behave similarly), but you are quite correct about the wtmp null user name 
on the Mandrake release 10.0 and I suspect all linux releases.

>> The native 'last' command operated on radwtmp with normal results, so I
>> suspect 'last' uses as index the host field instead of the name field.
>
>  I don't understand what you think are "normal" results here.  The
> "radlast" program is simply a 3-line shell script wrapper around the
> native "last" command.

Just found this out about the radlast doing "man radlast".  I guess my 
"normal" results come from a BSD perspective.


Best
David