LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-18-2017, 03:57 AM   #1
sgowthu
LQ Newbie
 
Registered: Dec 2017
Posts: 3

Rep: Reputation: Disabled
Why /var/log/wtmp file having 2 entries for ssh session.


When i do ssh /var/log/wtmp file having 2 enties,why it is happening.

root@firepower-1010:~# last
root ttyS0 Mon Dec 18 01:57 still logged in
root pts/0 64.103.219.215 Mon Dec 18 01:56 still logged in
root ssh 64.103.219.215 Mon Dec 18 01:56 still logged in
root pts/0 64.103.219.215 Mon Dec 18 01:55 - 01:55 (00:00)
root ssh 64.103.219.215 Mon Dec 18 01:55 - 01:55 (00:00)
root ttyS0 Mon Dec 18 01:54 - 01:57 (00:02)
root ttyS0 Mon Dec 18 01:54 - 01:54 (00:00)
root ttyS0 Mon Dec 18 01:54 - 01:54 (00:00)
 
Old 12-18-2017, 08:57 AM   #2
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,820
Blog Entries: 15

Rep: Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664
What distribution of Linux is this and what version of that distribution are you running?

The one line is showing which terminal (or pseudo-terminal) you came in on which is pts/0. The next line appears to be showing how you came in which is ssh.

Interestingly I don't see that in RHEL5 through RHEL7 but do see it in CoreOS. This makes me think it was a change made in the 4.x kernel or associated programs.
 
Old 12-18-2017, 09:07 AM   #3
sgowthu
LQ Newbie
 
Registered: Dec 2017
Posts: 3

Original Poster
Rep: Reputation: Disabled
Wind River Linux 8.0.0.22
 
Old 12-18-2017, 12:57 PM   #4
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,820
Blog Entries: 15

Rep: Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664Reputation: 1664
This page confirms Wind River Linux 8.x uses a 4.x kernel.
https://knowledge.windriver.com/en-u...2C_8.0/000/020

You can verify kernel version by typing "uname -r".

The fact you see it and I see it on CoreOS which also has 4.x kernel makes me think it is something that changed after 3.x which RHEL7 runs. I couldn't find any information on why it changed.

On doing a test just now a login via the remote console port shows I came in on tty1 (terminal) and does NOT show a second line for that session. It appears to me the second line when I went in via PuTTY was to show how I got to the system (ssh) and the first line was for the pseudo-terminal I was using for that session (pts/0).

It may be they added method so when you examine it you'll know whether users is on a real terminal (tty) or pseudo-terminal (pty often shown as pts/#). Any login to the same terminal will always get the same tty whereas each login to a pseudo-terminal gets it in the order of logged in users. i.e. First person logging in gets pts/0, second person pts/1, third person pts/3 etc... but next time around if second person logs in before original first person then he'd get pts/0.
 
Old 12-19-2017, 01:08 AM   #5
sgowthu
LQ Newbie
 
Registered: Dec 2017
Posts: 3

Original Poster
Rep: Reputation: Disabled
Yes there is some code changes happend in WRL8,only one entry seen on WRL6.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to Change the records from /var/log/wtmp file ?? GNU_chandrakant Linux - Newbie 2 09-05-2016 10:03 AM
How to make /var/log/wtmp file persistance. jaishiv5 Linux - Newbie 5 08-16-2013 02:49 AM
/var/log/wtmp mrant Linux - Security 4 07-14-2013 09:41 PM
/var/log/wtmp vs. /var/run/utmp masenko703 Linux - Newbie 4 10-05-2012 04:41 AM
Can Samhain log my entries in /var/log/secure and /var/log/mesage to a central server abefroman Linux - Software 2 04-13-2008 05:13 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 10:29 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration