Solved

Why does the last command does not display hostname for some logins?

Posted on 2008-06-17
5
231 Views
Last Modified: 2013-12-16
The last command on one of our development systems does not display the hostname for some of our logins, and there is not a corresponding entry for a login in /var/log/messages.  What could cause this?
alex     pts/1        chico.pao.efront Tue Jun 10 14:47 - 17:39  (02:51)
alex     pts/1        chico.pao.efront Tue Jun 10 11:43 - 11:44  (00:00)
release  pts/4                         Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/2                         Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/0                         Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/12                        Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/3                         Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/10                        Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/11                        Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/7                         Tue Jun 10 05:40 - 05:46  (00:05)

Open in new window

0
Comment
Question by:mikronixx
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 10

Assisted Solution

by:PeturIngiEgilsson
PeturIngiEgilsson earned 50 total points
ID: 21808628
I looked thro my 'last' on openSuSE 10.3

If i open up a new 'xterm' from within Gnome (i didn't try any other window manager) .. then a new enrty is added to wtmp (the file used by 'last ) without the hostname.

petur@oxygen:~> last
petur    pts/2        :0.0             Wed Jun 18 00:07   still logged in   # gnome-console started from within X
petur    pts/3                         Wed Jun 18 00:06 - 00:06  (00:00)     # xterm started from within X
petur    pts/3                         Wed Jun 18 00:04 - 00:05  (00:00)     # xterm started from within X
petur    pts/3        :0.0             Wed Jun 18 00:04 - 00:04  (00:00)   # gnome-console started from within X

Even more interesting is.. if i use the -i switch after last i'll get strange results:

petur@oxygen:~> last -i
petur    pts/2        0.0.0.0          Wed Jun 18 00:07   still logged in  
petur    pts/3        230.73.9.0       Wed Jun 18 00:06 - 00:06  (00:00)    # I've never seen that IP before..
petur    pts/3        235.21.2.0       Wed Jun 18 00:04 - 00:05  (00:00)    # Neither have i seen this one
petur    pts/3        0.0.0.0          Wed Jun 18 00:04 - 00:04  (00:00)    

It turns out those weird IP's are Class D ip addresses, they are reserved for multicast groups ( Packet or message sent across a network by a single host to multiple clients or devices. )

It could be that 'last' simply ignores ip's from that range and displays the hostname as a blank field.

try `last -i` .. if the login source address is in the range of 224.0.0.0 to 239.255.255.255 you can (i think?) assume it's from your local computer.

0
 

Author Comment

by:mikronixx
ID: 21808852
interesting:  i get the following with last -i:

release  pts/5        0.0.0.0          Tue Jun 17 09:58 - 10:13  (00:15)
release  pts/1        0.0.0.0          Tue Jun 17 09:58 - 10:13  (00:15)

i do not get multicast addresses.

no user should be able to login from the console.  This box is in a locked server room
0
 
LVL 10

Expert Comment

by:PeturIngiEgilsson
ID: 21809491
What is the purpose of the "release" user?
0
 
LVL 40

Accepted Solution

by:
omarfarid earned 75 total points
ID: 21809659
I think hostname / ip address will be displayed if the user is connecting or logging in from remote system. For login from the same system (e.g. console) the hostname is not displayed and it may show the ip 0.0.0.0 which is the local host.
0
 

Author Closing Comment

by:mikronixx
ID: 31468189
I am guessing what i am seeing is a fork from a script.  these answers work for me
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This is the error message I got (CODE) Error caused by incompatible libmp3lame 3.98-2 with ffmpeg I've googled this error message and found out sometimes it attaches this note "can be treated with downgrade libmp3lame to version 3.97 or 3.98" …
Setting up Secure Ubuntu server on VMware 1.      Insert the Ubuntu Server distribution CD or attach the ISO of the CD which is in the “Datastore”. Note that it is important to install the x64 edition on servers, not the X86 editions. 2.      Power on th…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question