Erik Auerswald wrote:
Linda A. Walsh noticed a similar thing:
The same thing happens on openSuSE
----
Looked into this a bit more and found that while
'w' and 'who' didn't work, "last" did.
Tracked it down to this...
from the linux programmer's manual UTMP(5)
it says conforming implementations should look in:
FILES
/var/run/utmp
/var/log/wtmp
--------------
tracing who (I assume 'w' uses similar code):
# strace who|& grep /var
access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or
directory)
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or
directory)
access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or
directory)
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or
directory)
----
I.e. it isn't checking the 2nd location.
Adding a link in the *ephemeral* (tmpfs/ramdisk) /var/run allows
it to temporarily work:
# ln -s ../log/wtmp utmp
who
law pts/0 2015-11-29 09:49 (athenae)
root tty1 2015-12-22 09:26
law pts/1 2015-12-23 16:57 (athenae)
law pts/0 2015-12-25 17:46 (athenae)
law pts/2 2015-12-25 21:42 (athenae)
law pts/4 2015-12-25 22:23 (athenae)
law pts/5 2015-12-27 08:46 (athenae)
law pts/6 2015-12-27 12:54 (athenae)
law pts/7 2015-12-27 12:59 (athenae)
w
13:18:22 up 108 days, 21:03, 459 users, load average: 1.33, 1.25, 0.99
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
law pts/0 athenae 29Nov15 39:52m 6:38 1.18s
dovecot/imap [l
root tty1 Tue09 3days 0.28s 0.28s -bash
law pts/1 athenae Wed16 2days 0.30s 0.30s -bash
law pts/0 athenae Fri17 39:52m 6:38 1.11s -bash
law pts/2 athenae Fri21 37:18m 0.42s 0.42s -bash
law pts/4 athenae Fri22 38:52m 0.25s 0.25s -bash
law pts/5 athenae 08:46 1:39m 0.57s 0.57s -bash
law pts/6 athenae 12:54 12:44 0.37s 0.37s -bash
law pts/7 athenae 12:59 0.00s 0.29s 0.01s w
last|grep 'still log'
law pts/7 athenae Sun Dec 27 12:59 still logged
in law pts/6 athenae Sun Dec 27 12:54 still
logged in law pts/5 athenae Sun Dec 27 08:46
still logged in law pts/4 athenae Fri Dec 25
22:23 still logged in law pts/2 athenae Fri
Dec 25 21:42 still logged in law pts/0 athenae
Fri Dec 25 17:46 still logged in law pts/1
athenae Wed Dec 23 16:57 still logged in root
tty1 Tue Dec 22 09:26 still logged in
----------------------------------------------
While creating a symlink in /var/run/utmp => /var/log/wtmp
is a per-boot, workaround to get this to work until 'w/who' are fixed,
both of them should check the linux-standard locations documented
in the manpage.
Likely /var/log is a new location (as /var/run was made ephemeral
as part of the transition to systemd). Note, there was some
pressure by the systemd folks to also make /var/log ephemeral
as well as /tmp and /var/tmp, but those were resisted, at least
in "SUSE"...(at least for now...), since the default for systemd
is to not store or save logfiles (or coredumps) over boots.
One can tell from design choices like that systemd is designed for
end-consumer systems, where logs that document things might
be inconvenient (vs. any publicly owned corporation, law group
bank or medical office where retaining logs for some period
of time is required by US law).