I noticed this behavior on my server today and I'd like to understand more about what's happening.

When issuing the w command while ssh'ed into my RHEL 6 server I was attempting to have the FROM field print the hostname rather than the IP of the SSH client. Note that I use for DNS and that resolution of google.com works fine with ping, for example.

So I edited /etc/hosts on the SSH server to include an entry for the client. Pinging the client by hostname now works fine, but w still displays the IP address in the FROM field.

Simply logging out and logging back in and issuing w again allowed the FROM field to list the SSH client by the hostname I configured in /etc/hosts.

My question is, why was the logout/login necessary? What changed or got updated upon logging back in?

I'm using bash-4.1.2-33.el6_7.1, the latest available in RHEL 6 base.


w reads /var/run/utmp to find out who is logged in and where they logged in from. utmp records are updated when a user logs in or logs out.

If there was no DNS or /etc/hosts entry for the IP at the time the user logged in then the hostname field in utmp is left empty by the login process (sshd in this case).

When you logged out and logged in again after adding the /etc/hosts entry, sshd performed a lookup on the IP and this time found a hostname, so was able to add the correct data to the hostname field in utmp.

see man 5 utmp for details on the file format of /var/run/utmp

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.