Re: last, lastlog, and desktop sessions

On Sat, Aug 10, 2013 at 3:08 AM, Bob Proulx <bob@proulx.com> wrote:

Joel Rees wrote:

> Joel Rees wrote:
> > I've never been clear about the last command. My memory is that it
> > recorded logins to the desktop as well as to ttyn devices.

To be pedantic the "last" command isn't recording anything. It is
only reporting what has already been recorded.

Yeah, that has become clear as I dig into this.

> > Today, I'm checking my logs, and I don't see any record of logins
> > to the desktop unless the user also started a shell in a virtual
> > terminal.

That would be due to your xdm, gdm, gdm3, lightdm, kdm or other
graphical login manager.

I recently switched from gdm or gdm3 (don't remember which) to lightdm.

It is responsible for recording desktop
logins. Some do. Some do not. If they don't then I think that is a
bug. But people who know about last and logins are becoming fewer
every day and so this part of the system has atrophied.

erk.

> > Has this changed recently? I'm I imagining things? Is there some setting
> > that changes this, that might have changed when I upgraded from squeeze to
> > wheezy?

Try different graphical login managers and compare them.

> Okay, I finally decided to log out of my X11 session on my netbook (Fedora)
> and found that my memory was wrong.
>
> last does not report logins to X11 desktop sessions.

What graphical login manager are you using? As I recall lightdm for
example does not record this information. I am pretty sure I saw that
there was a bug report on it. Ah... Here it is:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648604

Oh! Lookie there!

The relevant line from the bug report:

> In order to have lightdm write to the last log, you have to enable the
> pam_lastlog.so module in /etc/pam.d/lightdm with:
> 
> session optional pam_lastlog.so

(I think I need to start getting familiar with the debian bug reporting
 processes and lists.)

Anyway, I added that line to /etc/lightdm and /etc/lightdm-autologin, 

at the end, right before the @include common-password line, and I'm 
getting login logs again. who works again, etc.

Thanks, Bob.

[...]

--
Joel Rees