On Mon, Nov 22, 2021 at 11:39:46AM -0500, Greg Wooledge wrote:
I don't know the exact time that I closed the login shell on tty2. It *could* have been at exactly 11:19:00 but that seems like a suspiciously round number (and a suspiciously long time after I started the service).
You don't, but your system(d) does: the system instance, not the user instance. From my "journalctl --follow" output, after a "su -" and then immediately after closing the resulting shell: Nov 23 12:03:27 coil su[1330250]: pam_unix(su-l:session): session closed for user root -- Please do not CC me for listmail. 👱🏻 Jonathan Dowland ✎ jmtd@debian.org 🔗 https://jmtd.net