Sources of changes to /etc/motd and of other login messages?

[Lloyd Zusman <ljz@asfast.com>]

What process or utility changes the contents of /etc/motd?
Occasionally, I see an extra system identification line that has been
placed into that file.

Also, what causes the following prompt to print out at login, after
/etc/motd has been displayed?  ...

  Last login: Wed Dec 11 06:25:26 2002 from 204.212.175.30

I have put the following into /etc/pam.d/login:

  session    optional   pam_lastlog.so silent

However, that "Last login: ..." message still shows up.

This happens despite the fact that "LASTLOG_ENAB" is commented out in
/etc/login.defs, in the "OBSOLETED BY PAM" section.

Thanks in advance.

-- 
 Lloyd Zusman
 ljz@asfast.com