Hi all,

Usually, when I login to a RedHat box, locally or remotely,there comes out a
message like "Last login: Sun Jun 29 14:57:58 2003 from *.*.*.*". But these
days I found some of our RedHat 7.2 servers lost this message. When I login
to these boxes, I will directly see the command prompt like "[root@svr1
root]# ".
I guess maybe some configuration file was modified. Please help me out.
Any help will be appreciated.

Check and see if file /var/log/wtmp exists and what the permissions are.
Try command
last
which will read this file that stores the login session related info.

Hi nxny,

That's not what I mean...
I know /var/log/wtmp is responsibile for "last" command to show the login record. But what I mean is the message displayed when you login to a pts or tty. Please read my question instead of just my title.
Sorry for the misleading title...

My point is that the 'Last Login:' information comes from /var/log/wtmp. Since it ain't plaintext , I would use command 'last' to display the contents of the file in a meaningful way. If there is no source of information, it is likely that the message would be displayed at all. On the other hand, if there is indeed a wtmp and your message is still not being displayed, there is something else that's causing this. So first things first, do you have a root-readable-writeable wtmp?

Hi,

Please take a look at the following lines. I copy the text from the very beginning of my login.
----------------------------
[root@svr1 root]# last
root pts/2 branch-2-h130.st Wed Jul 2 10:52 still logged in
root pts/2 branch-2-h131.st Tue Jul 1 10:14 - 10:26 (00:11)
root pts/2 branch-2-h131.st Tue Jul 1 09:58 - 10:14 (00:15)
root pts/2 61.171.248.178 Mon Jun 30 19:18 - 19:23 (00:04)
root pts/2 61.171.249.177 Sun Jun 29 14:14 - 15:02 (00:47)
root pts/2 61.171.118.18 Fri Jun 27 20:17 - 20:17 (00:00)

wtmp begins Fri Jun 27 20:17:15 2003
[root@svr1 root]# ll /var/log/wtmp
-rw-rw-r-- 1 root utmp 4608 Jul 2 10:52 /var/log/wtmp
[root@svr1 root]#
---------------------------

Hi,

Can anyone help me out?

*First, regardless of whatever precautions you took, restrictions you set up or network layout, logging in as root is a bad thing to do. The responsable way is to login as user and sudo to root.

Two thinks to check: last login is read from /var/log/lastlog (root.root 0640) but readout will be suppressed when ~/.hushlogin exists.

lastlog!! that is a definitely great insight, unspawn.

yuzuo.. Are you remoting in via telnet or SSH ? If you're using SSH, it is unlikely that you may see the last login message, because AFAIK, ssh is linked against the PAM libraries directly to perform authentication ( as opposed to invoking /bin/login, which reads lastlog )