2

/var/log/btmp, the log read by default by the lastb command, stores information about failed login attempts. I'm looking at a snippet of a file and seeing what I understand to be minutes of logged-in time:

[#]> last -f /var/log/btmp.1 -10
test     ssh:notty    210.212.249.228  Tue Oct  1 06:04    gone - no logout
current  ssh:notty    115.133.236.49   Tue Oct  1 05:59 - 06:04  (00:05)
dudley   ssh:notty    host208.sub-63-4 Tue Oct  1 05:48 - 05:59  (00:10)
www      ssh:notty    net-5-88-155-130 Tue Oct  1 05:13 - 05:48  (00:34)
admin    ssh:notty    h106.205.186.173 Tue Oct  1 04:38 - 05:13  (00:35)
postmast ssh:notty    138.197.72.48    Tue Oct  1 04:27 - 04:38  (00:11)
ethos    ssh:notty    45.55.157.147    Tue Oct  1 03:53 - 04:27  (00:33)
usuario  ssh:notty    v133-130-107-88. Tue Oct  1 03:35 - 03:53  (00:17)
ftp      ssh:notty    36.66.156.125    Tue Oct  1 03:23 - 03:35  (00:12)
oracle5  ssh:notty    112.140.185.64   Tue Oct  1 03:02 - 03:23  (00:20)

How can users have been logged in for minutes if this log contains only failed logins?

1 Answer 1

Reset to default
1
+50

There's lastb for failed logins specifically in addition to last.

Here's the difference between them shown on the same system:

last:

% sudo last -f /var/log/btmp -F games
games    ssh:notty    ::1              Tue Nov 12 00:02:08 2019 - Tue Nov 12 00:10:02 2019  (00:07)
games    ssh:notty    ::1              Tue Nov 12 00:01:58 2019 - Tue Nov 12 00:02:08 2019  (00:00)

lastb:

% sudo lastb -F games
games    ssh:notty    ::1              Tue Nov 12 00:02:08 2019 - Tue Nov 12 00:02:08 2019  (00:00)
games    ssh:notty    ::1              Tue Nov 12 00:01:58 2019 - Tue Nov 12 00:01:58 2019  (00:00)

You could have noticed that something isn't really working out for last with your own example — last told you that the last user didn't logout: "gone - no logout". Another strange thing to notice would be chaining in logout and logins times: oracle5 is shown as logged out at 03:23 and 03:23 is the time stamp for ftp login.

So the short answer is: last isn't designed to handle failed logins. Use lastb instead.

1
  • 1
    Well that's interesting. I was trusting the manpage: "Lastb is the same as last, except that by default it shows a log of the file /var/log/btmp, which contains all the bad login attempts." but experimentally you're correct that they produce different data. Man pages aren't supposed to lie!
    – Xiong Chiamiov
    Nov 18, 2019 at 2:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .