"last" not showing recent login activity

[Matthias Petermann]

Hi Matthew,

Zitat von Matthew Seaman <m.seaman at infracaninophile.co.uk>:

> Errr... OK.  Yours is a different issue with utx.log.  It is not syslog
> that updates utx.log but the various programs like login(1) or sshd(8)
> that actually handle the authentication when you try and log in.  Most
> applications achieve that via the pam_lastlog(8) module.
>
> As to why you cannot see anything in the file beyond a certain point:
> perhaps the file data got corrupted in the middle? You might be able to
> tell by examining the file with hd(1) or getent(1) -- try:
>
>   getent utmpx log /var/log/utx.log
>
> You might also fine the getutxent(3) man page enlightening.

Thanks - that's exactly the information I was looking for. I investigated
the utx.log with getent and hd. Looks like your guess is proven - it contains
definitely more data than last actually shows. I did not find the reason
in detail yet but I could track this down to an event occured on the affected
machine during the time of the last shown data (had to perform a  
hardware reset
due to a hanging FS snapshot, causing me to do a manual fsck).

Kind regards,
Matthias