FreeBSD TTY Field – Why Does `last` Show ‘{‘ and ‘|’?

freebsdlasttty

We recently set up a new FreeBSD 7.2 machine on March 11. When looking at last, we noticed some funny characters for the TTY field.

What do these characters mean? Note that at this time, the sysadmin was battling with NTP.

# last |grep date
date             {                         Fri Mar 10 17:26
date             |                         Fri Mar 10 15:26
date             {                         Fri Mar 10 15:26
date             |                         Fri Mar 10 03:14
date             {                         Fri Mar 10 03:11
date             |                         Sat Mar 11 15:22
date             {                         Sat Mar 11 15:21
date             |                         Sat Mar 11 09:20

And according to man last, I can specify the tty using -t tty:

# last -t {
date             {                         Fri Mar 10 17:26
date             {                         Fri Mar 10 15:26
date             {                         Fri Mar 10 03:11
date             {                         Sat Mar 11 15:21

Best Answer

From utmp(5):

The system time has been manually or automatically updated (see
date(1)).  The command name date is recorded in the field
ut_name.  In the field ut_line, the character `|' indicates the
time prior to the change, and the character `{' indicates the
new time.

So the I and { are just there to indicate that the system time is being changed.

Related Solutions

Centos – “Last” command: How to show latest user login

last reads from a log file, usually /var/log/wtmp and prints the entries of successful login attempts made by the users in the past. The output is such that the last logged in users entry appears on top. In your case perhaps it went out of notice because of this.

In order to check when was the file /var/log/wtmp was written last, you can use stat command:

stat /var/log/wtmp

In order to print the output in reverse, you can pipe output of last to GNU tac (opposite of cat) as follows:

last | tac

Where does ‘last’ store user hostnames

According to man last, my Arch Linux system stores login info in /var/log/wtmp. It looks to be in a binary format - that is, the usual text tools will only show you parts of it.

This command: xxd /var/log/wtmp | more shows me both text-format dotted-quad IP addresses, and fully-qualified DNS names.

I wrote the following little program to show me what was in /var/log/utmp. It appears that not every entry has a hostname/IP address, and that the binary format only has a small, fixed amount of room for the hostname.

#include <stdio.h>
#include <utmp.h>

int
main(int ac, char **av)
{
        struct utmp *utmpp;
        utmpname("/var/log/wtmp");
        while (NULL != (utmpp = getutent())) {
                printf("%s\n", utmpp->ut_host);
        }
        endutent();
        return 0;
}

Best Answer

Related Solutions

Centos – “Last” command: How to show latest user login

Where does ‘last’ store user hostnames

Related Question