no the user is not insane, there really was a command named “last” which displays the last logged in users or the last boots and reboots was removed from Debian13 and replaced by entirely different program that needs to be installed manually

in a post systemd world, still using “service ssh status” to check the status of the ssh service

and then systemctrl stop ssh; systemctrl disable ssh;

so a combination of old and new just because relearning “how to do this and that” already learned things is additional effort

(renaming things and redesigning guis with every new version is the way M$ drives it’s users insane with every paid update)

# Debian12
ll /usr/bin/last
-rwxr-xr-x 1 root root 67K 2024-11-21 21:01 /usr/bin/last

man: last.man.txt

# Debian13
su - root
apt update
apt install lastlog2
ll /usr/bin/last
/usr/bin/last -> wtmpdb; # which is a softlink to /usr/bin/wtmpdb

man: wtmpdb.man.txt

wtmpdb – display login, logout and reboot information (Debian package tracker)

there is no /var/log/lastlog file anymore

cat /var/log/lastlog
�+�ftty1��gpts/0123.123.123.123 �gpts/0145.224.72.181Bq�gpts/1123.123.123.123

su - root
apt install sqlite3
sqlite3 /var/lib/wtmpdb/wtmp.db
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
wtmp
sqlite> SELECT * FROM wtmp;
1|1|reboot|1744002890677651||~|6.12.12-amd64|
2|3|root|1744007467202374|1744007484667145|pts/3||su-l
3|3|root|1744007630526148||pts/3||su-l
4|3|root|1744007715738770||pts/2||su-l

Who did it? the Kukuk from SUSE: https://thkukuk.de/blog/Y2038_glibc_lastlog_64bit/

needed a rewrite because of Y2038?

“lastlog2 binary will replace lastlog and allows to import that old /var/log/lastlog file, to maintain the data and of course to show the last login data.”

“Were other alternatives evaluated?”

“Yes, but in the end, sqlite was the most widespread, robust, well maintained database library available today.”

“people probably not eve notice the change” well guess just did that, what is it with SUSE? X-D trolling the GNU Linux world since decades? X-D

Why the strange naming?

wtmp = water temperature?

  • utmp maintains a full accounting of the current status of the system
    • utmp.man.txt
    • system boot time (used by uptime)
    • recording user logins at which terminals
    • logouts
    • system events etc.
  • wtmp acts as a historical utmp
  • btmp records failed login attempts (src: Wiki)
    • (no man entry for btmp)

“names utmp and wtmp go all the way back to earliest days of UNIX in the 1970’s”

“Both files existed in UNIX v6, where the ac and who commands would report on their contents. (Curiously the who command would report “cannot open wtmp“ if /etc/utmp was unreadable”

“Initially utmp was in /etc and wtmp was in /usr/adm/wtmp”

“Both files were moved under /var when that was split from /usr in the 1980’s, at first into /var/adm and later into /var/log”

“To be sure why those names were chosen you’d have to ask Ken Thompson, or search through Dennis Richie’s archive”

“suspect that /etc/utmp was created first and the others names were based on it. Being in /etc where everything else was static may have contributed to using tmp for a file that was created anew each time the system is booted. Or perhaps it was a temporary idea that caught on, and kept its quixotic filename” (src)

Links:

https://microos.opensuse.org/blog/2023-06-28-switch-to-wtmpdb/

liked this article?

  • only together we can create a truly free world
  • plz support dwaves to keep it up & running!
  • (yes the info on the internet is (mostly) free but beer is still not free (still have to work on that))
  • really really hate advertisement
  • contribute: whenever a solution was found, blog about it for others to find!
  • talk about, recommend & link to this blog and articles
  • thanks to all who contribute!
admin