Peter C. Lai [mailto:sir...@cowbert.2y.net] wrote:
all true and good, but i think my issue was that suppose a 3rd party
application doesn't log correctly at all (in the case i
mentioned, it could
be the shell's or pam's or sshd's fault (or some combination
it does not regard HUPing a shell as a proper logout.).
Changing the way
utmp/wtmp is recorded isn't going to change the data.
However, i did say i
probably posted to the wrong thread, but it is still related
to the issue of
erroneous data in lastlog.
If you want to 'solve' that you will require kernel hooks of some kind
which hook into the begin&exit calls of the task/thread/process.
This way one can also catch broken/crashed applications. Then again
lastlog/who != ps :)
To Unsubscribe: send mail to majo...@FreeBSD.org
with "unsubscribe freebsd-arch" in the body of the message