1

While testing the last command on my system I got the following result and could not make sense of the lines with down and crash at their ends, as all seem to be connected to a tty7 login:

george   tty7         :0               Sat Dec 24 18:05 - down   (15:29)
reboot   system boot  4.4.0-57-generic Sat Dec 24 18:02 - 09:35  (15:32)
george   tty7         :0               Sat Dec 24 14:03 - crash  (03:58)
reboot   system boot  4.4.0-57-generic Sat Dec 24 13:48 - 09:35  (19:46)
george   tty7         :0               Sat Dec 24 12:48 - crash  (00:59)
reboot   system boot  4.4.0-57-generic Sat Dec 24 12:45 - 09:35  (20:50)
george   tty7         :0               Sat Dec 24 09:47 - crash  (02:57)
reboot   system boot  4.4.0-57-generic Sat Dec 24 09:44 - 09:35  (23:50)
george   tty7         :0               Sat Dec 24 09:41 - down   (00:01)
reboot   system boot  4.4.0-57-generic Sat Dec 24 09:38 - 09:42  (00:04)
george   tty7         :0               Sat Dec 24 08:42 - down   (00:51)
reboot   system boot  4.4.0-57-generic Sat Dec 24 08:36 - 09:33  (00:57)
george   tty7         :0               Fri Dec 23 21:36 - crash  (11:00)
reboot   system boot  4.4.0-57-generic Fri Dec 23 21:33 - 09:33  (11:59)

When I run lastlog also I get this result:

Username         Port     From             Latest
root                                       **Never logged in**
daemon                                     **Never logged in**
bin                                        **Never logged in**
sys                                        **Never logged in**
sync                                       **Never logged in**
games                                      **Never logged in**
man                                        **Never logged in**
lp                                         **Never logged in**
mail                                       **Never logged in**
news                                       **Never logged in**
uucp                                       **Never logged in**
proxy                                      **Never logged in**
www-data                                   **Never logged in**
backup                                     **Never logged in**
list                                       **Never logged in**
irc                                        **Never logged in**
gnats                                      **Never logged in**
nobody                                     **Never logged in**
syslog                                     **Never logged in**
messagebus                                 **Never logged in**
usbmux                                     **Never logged in**
dnsmasq                                    **Never logged in**
avahi-autoipd                              **Never logged in**
kernoops                                   **Never logged in**
rtkit                                      **Never logged in**
saned                                      **Never logged in**
whoopsie                                   **Never logged in**
speech-dispatcher                           **Never logged in**
avahi                                      **Never logged in**
lightdm                                    **Never logged in**
colord                                     **Never logged in**
hplip                                      **Never logged in**
pulse                                      **Never logged in**
george           tty1                      Sun Dec 11 08:41:03 +0100 2016
postfix                                    **Never logged in**
mysql                                      **Never logged in**
clamav                                     **Never logged in**
postgres                                   **Never logged in**
ftp                                        **Never logged in**
debian-spamd                               **Never logged in**
libvirt-qemu                               **Never logged in**
libvirt-dnsmasq                            **Never logged in**
systemd-timesync                           **Never logged in**
systemd-network                            **Never logged in**
systemd-resolve                            **Never logged in**
systemd-bus-proxy                           **Never logged in**
uuidd                                      **Never logged in**
_apt                                       **Never logged in**
mongodb                                    **Never logged in**
redis                                      **Never logged in**
mssql                                      **Never logged in**
sshd                                       **Never logged in**

Now I expected to see:

  1. A login from tty1 for user george (i.e. me) in the last command, rather I see tty7 and with crash attached

  2. A more recent entry for user george in the result of lastlog command, but I see:

      george           tty1          Sun Dec 11 08:41:03 +0100 2016

So I run lastlog -u george just to be sure I am not doing something wrong, and I still see same date as in lastlog command result.

Username         Port     From             Latest
george           tty1                      Sun Dec 11 08:41:03 +0100 2016

Questions:

  1. Why are the entries for user george from tty7 rather than from tty1?
  2. What do the down and crash entry means as I have not experienced any crash as far as I know?
  3. Why is there no entry for user george in the results of lastlog -u george?
  4. Why is the entry for user george in lastlog from a past date when I have since been logging after that date?

Note:

I have seen this Difference between last and lastlog? and it does not answer my question.

Jeff Schaller
  • 67,283
  • 35
  • 116
  • 255
George Udosen
  • 1,867
  • Saying the provided link doesn't answer your question while it appears to answer it would certainly justify an explanation. Both commands do not take the data from the same place. I think your tty7 is a terminal window opened in X, right? – Julie Pelletier Dec 30 '16 at 06:00
  • 1
    As for the crash indicator, just take a look at the time the machine rebooted and you'll see the session in question ended abruptly because of the reboot. – Julie Pelletier Dec 30 '16 at 06:02
  • The reason I said so is it doesn't address the reason why I have an old date in lastlog records for user george which is me the system owner. I expected to see a more recent date. Perhaps I am missing something – George Udosen Dec 30 '16 at 06:05
  • Ok I see, I often reboot abruptly hence the crash. What of the old date entry from the 11th when I have since logged in many times. – George Udosen Dec 30 '16 at 06:10
  • Both commands rely on different information that is not controlled by them. The lastlog strictly relies on actual logins, not session which are shown in last. Opening a terminal window does not require you to log in. – Julie Pelletier Dec 30 '16 at 06:12
  • So how come I can't see a recent entry for my log ins in lastlog. Perhaps I don't understand what a log in means to the system – George Udosen Dec 30 '16 at 06:20
  • I would suspect the last time you logged in to a shell (with a password prompt) was on the 11th. It apparently doesn't log it there when you sign-on to your X session. – Julie Pelletier Dec 30 '16 at 06:40

0 Answers0