For no reason "full" did something else than "iso" or -F as you
see here:
$ ./last -f ../tests/ts/last/wtmp.LE --time-format=full | grep -A2 "no logout"
torvalds linux hobby Mon Aug 26 02:57:08 1991 gone - no logout
reboot system boot system-name Wed Aug 28 20:00:00 2013 still running
reboot system boot system-name Wed Aug 28 18:00:00 2013 - Wed Aug 28 19:00:00 2013 (01:00)
$ ./last -f ../tests/ts/last/wtmp.LE --time-format=iso | grep -A2 "no logout"
torvalds linux hobby 1991-08-26T02:57:08+0200 gone - no logout
reboot system boot system-name 2013-08-28T20:00:00+0200 still running
reboot system boot system-name 2013-08-28T18:00:00+0200 - 2013-08-28T19:00:00+0200 (01:00)
$ ./last -f ../tests/ts/last/wtmp.LE -F | grep -A2 "no logout"
torvalds linux hobby Mon Aug 26 02:57:08 1991 gone - no logout
reboot system boot system-name Wed Aug 28 20:00:00 2013 still running
reboot system boot system-name Wed Aug 28 18:00:00 2013 - Wed Aug 28 19:00:00 2013 (01:00)
Also note the useless leading space before "gone"
The only thing which matters is fmt->out width when printing these
strings like "still running". Now ctl->fulltime flag is unsused and
removed.
Signed-off-by: Ruediger Meier <ruediger.meier@ga-group.nl>
The /proc/<pid>/loginuid is not always available, and when so a running
session should not be determined to be gone. This is a regression from
commit mentioned in reference.
Sessions that have started before previous system boot, and did not log
out meanwhile, will be marked as gone. It is fair to say that these
sessions are most likely result of a wtmp corruption.
Reference: 404fa3f93c
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
Earlier determination that used kill with signal zero to pid was prone to
false positive reports, due reuse of pid space and unrelated processes.
New function is_phantom() tries do a little bit better job, but fails to
be perfect. It seems linking to gether utmp session start time or
terminal id with /proc/<pid>/ information is not as simple as one might
hope.
Reported-by: Karel Zak <kzak@redhat.com>
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
In include/bits/utmp.h the ut_user and ut_time macros are marked with
comment they are backwards compatibility hacks. It is probably best to
avoid use of these macros where ever possible.
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
Use of uptime time stamp as previous boot login time makes the output not
constant, which is rather difficult to test. Verbal message 'system is
still running' makes testing easy, and noticing which boot is still
running clear to a person.
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
When a session time will reach whopping 10000 days the last round bracket
is unnecessarily removed from output.
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
The ISO-8601 format makes consuming time stamps easy with various
parsers. The format includes time zone information which is crucial when
an investigator is trying to make sense outputs collected from systems
all a across planet.
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
This allows reducing global variables and will minimize number of
arguments for functions making code a little bit easier to read, and
maintain.
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
Even while the YYYYMMDDHHMMSS time format it not magnificent it is best
to make it to be part of the one, and only, time format parser.
Proposed-by: Karel Zak <kzak@redhat.com>
References: http://markmail.org/message/6baqt4ttkopu7ra6
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
Comment in the deletion tells everything necessary.
"This doesn't work on modern systems, where only a DNS lookup of the
result from hostname() will get you the domainname. Remember that
domainname() is the NIS domainname, not DNS. So basically this whole
piece of code is bullshit."
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
Incremental number lists are more hard to get wrong with enum, and they
are nicer to debug as for example gdb is aware of these symbolic names.
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
Some of the ut_type numbers does not seem to be recognized by last(1) so
they are, at least for now, silently ignored. See glibc documentation
for information what the ignored EMPTY, INIT_PROCESS, LOGIN_PROCESS, and
ACCOUNTING mean.
Reference: FIXME
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
This commit also changes the line count to use unsigned integers, as
negative numbers in this context does not make sense.
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
Calling abort() as default seems appropriate as the default should be
impossible to reach.
last.c:355:3: warning: switch missing default case [-Wswitch-default]
And simple line removals.
last.c:110:13: warning: redundant redeclaration of 'optind' [-Wredundant-decls]
last.c:111:15: warning: redundant redeclaration of 'optarg' [-Wredundant-decls]
Signed-off-by: Sami Kerola <kerolasa@iki.fi>
Solaris lacks err, errx, warn and warnx. This also means the err.h header
doesn't exist. Removed err.h include from all files, and included err.h from
c.h instead if it exists, otherwise alternatives are provided.
Signed-off-by: Fabian Groffen <grobian@gentoo.org>
The utmp.ut_time is timeval.tv_sec (time_t) or int32_t. It's more
robust not to use ctime() or time() directly.
Signed-off-by: Karel Zak <kzak@redhat.com>
Ruediger Meier
Karel Zak
Sami Kerola
Benno Schulenberg
Ondrej Oprala
Fabian Groffen
Marek Polacek
Davidlohr Bueso