• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 236
  • Last Modified:

Why does the last command does not display hostname for some logins?

The last command on one of our development systems does not display the hostname for some of our logins, and there is not a corresponding entry for a login in /var/log/messages.  What could cause this?
alex     pts/1        chico.pao.efront Tue Jun 10 14:47 - 17:39  (02:51)
alex     pts/1        chico.pao.efront Tue Jun 10 11:43 - 11:44  (00:00)
release  pts/4                         Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/2                         Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/0                         Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/12                        Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/3                         Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/10                        Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/11                        Tue Jun 10 05:40 - 05:46  (00:05)
release  pts/7                         Tue Jun 10 05:40 - 05:46  (00:05)

Open in new window

0
mikronixx
Asked:
mikronixx
  • 2
  • 2
2 Solutions
 
Pétur Ingi EgilssonSoftware Engineer -- ConsultantCommented:
I looked thro my 'last' on openSuSE 10.3

If i open up a new 'xterm' from within Gnome (i didn't try any other window manager) .. then a new enrty is added to wtmp (the file used by 'last ) without the hostname.

petur@oxygen:~> last
petur    pts/2        :0.0             Wed Jun 18 00:07   still logged in   # gnome-console started from within X
petur    pts/3                         Wed Jun 18 00:06 - 00:06  (00:00)     # xterm started from within X
petur    pts/3                         Wed Jun 18 00:04 - 00:05  (00:00)     # xterm started from within X
petur    pts/3        :0.0             Wed Jun 18 00:04 - 00:04  (00:00)   # gnome-console started from within X

Even more interesting is.. if i use the -i switch after last i'll get strange results:

petur@oxygen:~> last -i
petur    pts/2        0.0.0.0          Wed Jun 18 00:07   still logged in  
petur    pts/3        230.73.9.0       Wed Jun 18 00:06 - 00:06  (00:00)    # I've never seen that IP before..
petur    pts/3        235.21.2.0       Wed Jun 18 00:04 - 00:05  (00:00)    # Neither have i seen this one
petur    pts/3        0.0.0.0          Wed Jun 18 00:04 - 00:04  (00:00)    

It turns out those weird IP's are Class D ip addresses, they are reserved for multicast groups ( Packet or message sent across a network by a single host to multiple clients or devices. )

It could be that 'last' simply ignores ip's from that range and displays the hostname as a blank field.

try `last -i` .. if the login source address is in the range of 224.0.0.0 to 239.255.255.255 you can (i think?) assume it's from your local computer.

0
 
mikronixxAuthor Commented:
interesting:  i get the following with last -i:

release  pts/5        0.0.0.0          Tue Jun 17 09:58 - 10:13  (00:15)
release  pts/1        0.0.0.0          Tue Jun 17 09:58 - 10:13  (00:15)

i do not get multicast addresses.

no user should be able to login from the console.  This box is in a locked server room
0
 
Pétur Ingi EgilssonSoftware Engineer -- ConsultantCommented:
What is the purpose of the "release" user?
0
 
omarfaridCommented:
I think hostname / ip address will be displayed if the user is connecting or logging in from remote system. For login from the same system (e.g. console) the hostname is not displayed and it may show the ip 0.0.0.0 which is the local host.
0
 
mikronixxAuthor Commented:
I am guessing what i am seeing is a fork from a script.  these answers work for me
0

Featured Post

Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now