Hi Valentin, On Wed, Nov 12, 2025 at 01:05:29PM +0100, Valentin Haudiquet wrote: > [...] > > Do you see any suspicious lines in the output of the "w", "who", and/or > > "last" commands? I.e., any entry in the TTY column that does not look > > like a TTY, or a missing entry in that column? > > Yes ! w and who are normal, but last shows: > ``` > [vhaudiquet@x1c inetutils <merge-lp2130124-resolute>]$ last > vhaudiqu tty2 tty2 Thu Nov 6 12:00 - still logged in > vhaudiqu seat0 login screen Thu Nov 6 12:00 - still logged in > vhaudiqu tty2 tty2 Sat Nov 1 19:03 - still logged in > vhaudiqu seat0 login screen Sat Nov 1 19:03 - still logged in > vhaudiqu tty2 tty2 Tue Oct 28 11:39 - still logged in > vhaudiqu seat0 login screen Tue Oct 28 11:39 - still logged in > vhaudiqu tty2 tty2 Tue Oct 28 07:02 - still logged in > vhaudiqu seat0 login screen Tue Oct 28 07:02 - still logged in > vhaudiqu tty2 tty2 Mon Oct 27 17:36 - still logged in > vhaudiqu seat0 login screen Mon Oct 27 17:36 - still logged in > vhaudiqu tty2 tty2 Mon Oct 27 16:44 - still logged in > vhaudiqu seat0 login screen Mon Oct 27 16:44 - still logged in > vhaudiqu tty2 tty2 Tue Oct 7 17:11 - still logged in > vhaudiqu seat0 login screen Tue Oct 7 17:11 - still logged in > vhaudiqu tty2 tty2 Thu Oct 2 23:13 - still logged in > vhaudiqu seat0 login screen Thu Oct 2 23:13 - still logged in > vhaudiqu tty2 tty2 Thu Oct 2 14:29 - still logged in > vhaudiqu seat0 login screen Thu Oct 2 14:29 - still logged in > vhaudiqu tty2 tty2 Thu Oct 2 14:26 - still logged in > vhaudiqu seat0 login screen Thu Oct 2 14:26 - still logged in > vhaudiqu tty2 tty2 Thu Oct 2 12:34 - still logged in > vhaudiqu seat0 login screen Thu Oct 2 12:34 - still logged in > vhaudiqu tty2 tty2 Thu Oct 2 12:00 - still logged in > vhaudiqu seat0 login screen Thu Oct 2 12:00 - still logged in > vhaudiqu tty2 tty2 Thu Oct 2 11:50 - 11:59 (00:09) > vhaudiqu seat0 login screen Thu Oct 2 11:50 - still logged in > vhaudiqu tty2 tty2 Thu Oct 2 11:35 - still logged in > vhaudiqu seat0 login screen Thu Oct 2 11:35 - still logged in > vhaudiqu tty2 tty2 Thu Oct 2 11:20 - still logged in > vhaudiqu seat0 login screen Thu Oct 2 11:20 - still logged in > ``` > > However, that is also the case on Questing and older Ubuntu releases. > And to my understanding that is normal :)
I'd like to get a better understanding of those utmp entries. Could you also provide (part of) the output of "utmpdump /var/run/utmp"? I wonder if the "seat0" resp. "sshd" entries have a different type (ut_type, the first value in each line printed by "utmpdump") than the "ttyN" or "pts/N" ones. > [...] Thanks, Erik
