Hi, It seems that utmpdump is not built on Debian / Ubuntu since December 2024.
> util-linux (2.40.2-12) unstable; urgency=medium > > * Stop building utmpdump, should not be necessary on wtmpdb systems > * Stop marking mkfds-socketpair test as failing > * Skip tmpfs-sensitive tests if fstype cannot be determined > * Amend NEWS entry to hint updating /root/.profile (Closes: #1088009) > > -- Chris Hofstaedtler <[email protected]> Fri, 06 Dec 2024 13:35:11 +0100 I can try to compile that from source, but I wonder if the output will be relevant then, given that they decided to stop building it. I'm not familiar with "wtmp" as well, so this gives me something more to read on ! Thanks, Valentin On Thu, 13 Nov 2025 at 10:40, Erik Auerswald <[email protected]> wrote: > > Hi Valentin, > > On Wed, Nov 12, 2025 at 01:05:29PM +0100, Valentin Haudiquet wrote: > > [...] > > > Do you see any suspicious lines in the output of the "w", "who", and/or > > > "last" commands? I.e., any entry in the TTY column that does not look > > > like a TTY, or a missing entry in that column? > > > > Yes ! w and who are normal, but last shows: > > ``` > > [vhaudiquet@x1c inetutils <merge-lp2130124-resolute>]$ last > > vhaudiqu tty2 tty2 Thu Nov 6 12:00 - still logged in > > vhaudiqu seat0 login screen Thu Nov 6 12:00 - still logged in > > vhaudiqu tty2 tty2 Sat Nov 1 19:03 - still logged in > > vhaudiqu seat0 login screen Sat Nov 1 19:03 - still logged in > > vhaudiqu tty2 tty2 Tue Oct 28 11:39 - still logged in > > vhaudiqu seat0 login screen Tue Oct 28 11:39 - still logged in > > vhaudiqu tty2 tty2 Tue Oct 28 07:02 - still logged in > > vhaudiqu seat0 login screen Tue Oct 28 07:02 - still logged in > > vhaudiqu tty2 tty2 Mon Oct 27 17:36 - still logged in > > vhaudiqu seat0 login screen Mon Oct 27 17:36 - still logged in > > vhaudiqu tty2 tty2 Mon Oct 27 16:44 - still logged in > > vhaudiqu seat0 login screen Mon Oct 27 16:44 - still logged in > > vhaudiqu tty2 tty2 Tue Oct 7 17:11 - still logged in > > vhaudiqu seat0 login screen Tue Oct 7 17:11 - still logged in > > vhaudiqu tty2 tty2 Thu Oct 2 23:13 - still logged in > > vhaudiqu seat0 login screen Thu Oct 2 23:13 - still logged in > > vhaudiqu tty2 tty2 Thu Oct 2 14:29 - still logged in > > vhaudiqu seat0 login screen Thu Oct 2 14:29 - still logged in > > vhaudiqu tty2 tty2 Thu Oct 2 14:26 - still logged in > > vhaudiqu seat0 login screen Thu Oct 2 14:26 - still logged in > > vhaudiqu tty2 tty2 Thu Oct 2 12:34 - still logged in > > vhaudiqu seat0 login screen Thu Oct 2 12:34 - still logged in > > vhaudiqu tty2 tty2 Thu Oct 2 12:00 - still logged in > > vhaudiqu seat0 login screen Thu Oct 2 12:00 - still logged in > > vhaudiqu tty2 tty2 Thu Oct 2 11:50 - 11:59 (00:09) > > vhaudiqu seat0 login screen Thu Oct 2 11:50 - still logged in > > vhaudiqu tty2 tty2 Thu Oct 2 11:35 - still logged in > > vhaudiqu seat0 login screen Thu Oct 2 11:35 - still logged in > > vhaudiqu tty2 tty2 Thu Oct 2 11:20 - still logged in > > vhaudiqu seat0 login screen Thu Oct 2 11:20 - still logged in > > ``` > > > > However, that is also the case on Questing and older Ubuntu releases. > > And to my understanding that is normal :) > > I'd like to get a better understanding of those utmp entries. Could you > also provide (part of) the output of "utmpdump /var/run/utmp"? I wonder > if the "seat0" resp. "sshd" entries have a different type (ut_type, > the first value in each line printed by "utmpdump") than the "ttyN" or > "pts/N" ones. > > > [...] > > Thanks, > Erik
