[adding the bug report back in] On Mon, Mar 16, 2026 at 06:55:50PM -0300, Ruan wrote: > Em 16/03/2026 16:10, Andrew Bower escreveu: > On Mon, Mar 16, 2026 at 02:03:51PM -0300, Ruan wrote: > > I'm not entirely sure how to send the log, but I can send the output in this > case.
That's great to start with, thanks! > user@desktop:~$ last > user tty1 Mon Mar 16 18:33 - still logged in > xydm tty2 :0 Mon Mar 16 18:30 - 18:33 (00:03) > reboot system boot 6.12.74+deb13+1- Mon Mar 16 18:28 - still running > user tty1 Mon Mar 16 13:54 - crash This means the session was (deemed) never to have been closed before shutdown. It doesn't actually mean the machine crashed, just that a closure of the login session was not recorded with wtmpdb. > xydm tty2 :0 Mon Mar 16 13:54 - 13:54 (00:00) > reboot system boot 6.12.74+deb13+1- Mon Mar 16 13:53 - 14:10 (00:17) > user tty1 Mon Mar 16 11:22 - crash > xydm tty2 :0 Mon Mar 16 11:21 - 11:22 (00:01) > reboot system boot 6.12.74+deb13+1- Mon Mar 16 11:20 - 13:52 (02:31) > user tty1 Sun Mar 15 18:04 - crash > xydm tty2 :0 Sun Mar 15 18:03 - 18:04 (00:00) > reboot system boot 6.12.74+deb13+1- Sun Mar 15 18:02 - 01:38 (07:36) > user tty1 Sun Mar 15 17:27 - crash > xydm tty2 :0 Sun Mar 15 17:27 - 17:27 (00:00) > user tty1 Sun Mar 15 17:12 - 17:27 (00:15) It looks like console logins *do* normally get recorded. It's presumably just when you shutdown that there's a problem. > As you can see, the "crashes" compromise the reading of logins, even > though the system did not experience any forced shutdown or session > interruption. Thanks for the confirmation. If you have a syslogger it might be good to take a look at the logging from PAM with an extract from /var/log/auth. I see you are running systemd so if you don't have a syslogger you might have to find out how to get this information using journalctl: Do you get both of these lines before shutdown in this log file for the user login on tty1? Mar 17 00:12:02 [login] pam_unix(login:session): session opened for user andy(uid=1000) by andy(uid=0) Mar 17 00:12:06 [login] pam_unix(login:session): session closed for user andy If you only get the 'open' message then it seems something about how systemd terminates your virtual console logins means the PAM routines (which cause the logout entry to be written) are not getting a chance to run. > reboot system boot 6.12.74+deb13+1- Sun Mar 15 16:17 - 16:59 (00:41) > root pts/1 Sun Mar 15 16:04 - 16:05 (00:01) > user tty1 Sun Mar 15 16:01 - crash > xydm tty2 :0 Sun Mar 15 16:01 - 16:01 (00:00) I see this is not an issue for pseudo ttys as the session on pts/1 above is closed OK. If you *do* get the 'close' message then we will need to look into what happens when wtmpdb'd pam routine gets called in these conditions. What getty are you running?
