Hi,

I am testing "last" and "who" commands on my own PC. Apart from me, who is the only user and the reboots, I can see "unknown" users in what "last" produces:

what does it mean?

are you using Fedora?

yes

Then probably: https://bugzilla.redhat.com/show_bug.cgi?id=760834

yes I saw that too. But the "who" command returns normally, the "last" is giving me such messages.

because "who" does see users logged now.

unknown is 21 Jan, so you can see it just with "last" command

Try to reproduce the bug and use who command.

actually, I can see many "unknown" when I execute "last", I just mentioned one of them in my post here.

man last
man who

when you reproduce the bug, and use who, you'll see it.

It isn't really a bug.

When one of the xdm/kdm/gdm/... session managers start they allocate a terminal (first unused terminal, which can be tty1). To record the fact that it is in use the xdm/kdm/gdm register it as in use by gdm for the purpose of running X (the :0 entry).

You get multiple entries when you use the "user switch" option of a screen lock, which directs the xdm/kdm/gdm/... session manager to start a new X server, and allocate a new terminal.

The "unknown" is put in the user field of the utmp entry because until a user logs in, it is unknown as to what user it will be.

As a last thing that can cause confusion... if a graceful shutdown is not done (or the user aborts the X server for some reason) the "unknown" can remain behind as an incomplete record, showing additional "unknown" entries.

1 members found this post helpful.