"last" providing incorrect information on Solaris 8

[Steve VanDevender]

Darren Moffat writes:
 > >The "last <username>" usage is displaying the sessions as still being
 > >logged on the server when it's really not.  The "last" by itself shows
 > >correct information about the session.     Sometimes using the "last
 > ><username>" syntax  the session shows being terminated but the total
 > >logged in time is hours off.

I've seen a similar problem, but ascribe it to a discrepancy between the
way Solaris utilities record wtmpx logout records and the way most other
systems do.  Solaris records the username in both login and logout
records, while other systems record the username only in the login
record, and find the matching logout record according to the other
session data in the login record.  The wtmpx handling in OpenSSH does
the latter, so it creates logout records that the Solaris 'last' command
doesn't match up with the corresponding login records.

I hack OpenSSH locally so that in Solaris it does not prematurely return
in the functions that fill in wtmpx logout records.  I've been intending
to float it to the developers for a while, but just haven't sat down to
polish it up for submission.

 > See the following Sun bugs in SunSolve:
 > 
 > 1.  "last" problem - wtmpx entries not properly updated when logging out
 >     Bug:  1171613
 > 2.  wtmpx entries not properly updated when logging out
 >     Bug:  4027052
 > 3.  *last* produces inconsistent results when specifying name.
 >     Bug:  4010009
 > 4.  *last* The last command does not show ftp sessions if using a name
 >     Bug:  4095482
 > 5.  last command shows still logged on when user is logged out
 >     Bug:  4119214
 > 6.  *last* last command does not show correct-logout time (ftp login)
 >     Bug:  1260759
 > 
 > 
 > I believe these are releated to the problem you are seeing.
 >     
 > --
 > Darren J Moffat