on a redhat server I logged with my domain username, and then switched as root. As I switched as root I received the message for the last login for root (Last login: ....). I am asking if the "last login" message displays the date that every user logged/switched as root, or it displays the date that my username switched as root. The strange thing is that the date displayed for the last login as root was 2 month before the last record in wtmp. Thanks a lot, best of all.
1 Answer
You did not elaborate on what exactly you mean by "switched as root". I assume you were using the command su -, possibly in the form sudo su -. As described on its manpage, this command starts a new login shell for the root user. The "last login" message reports the last time a login shell was started for the same user.
In response to your question this means that the "last login" message appearing after su - reports the last time anyone switched to root via su - or logged in directly as root. The same holds for the "last login" message appearing when you log in directly as root.
-
1Hi! I've used the command "sudo su -", it's the same for "su - root", true?– DeadaliveJun 15, 2021 at 18:15
-