>Number:         5686
>Category:       bin
>Synopsis:       wtmp does not log logouts when file is cycled via newsyslog
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jul  1 10:20:01 1998
>Last-Modified:
>Originator:     Heiko W.Rupp
>Organization:
private
>Release:        NetBSD 1.3.2
>Environment:
	
System: NetBSD dr.zook 1.3.2 NetBSD 1.3.2 (DR.ZOOK) #0: Tue Jun 2 19:07:13 MEST 1998 hwr@dr.zook:/usr/src/sys/arch/i386/compile/DR.ZOOK i386


>Description:

A user logs in. Its login is recorded in wtmp.
Then after some time wtmp is rotated via newsyslog to some wtmp.0.gz
When user logs out, there is no trace (at least not visible with
'last'

Thus you can see the login time by using
$ gzcat wtmp.0.gz > foo
$ last -f foo

In this case the user is reported as 'still logged in'

but 

$ last 

will not show the logout time.

	

>How-To-Repeat:

snert# pwd
/var/log
snert# last  
uselx     ttyp8    sun-ks.xxx.net   Tue Jun 30 16:01 - 16:09  (00:07)
hwr       ftp      tp71.rz.xxxxxxxx Tue Jun 30 15:55 - 16:01  (00:06)
hwr       ftp      tp71.rz.xxxxxxxx Tue Jun 30 10:01 - 10:08  (00:06)

wtmp begins Tue Jun 30 10:01 
snert# gzcat wtmp.0.gz > foo
snert# last -f foo
neo       ttyp7    andrea.xxxxxxxxx Mon Jun 29 16:31   still logged in
neo       ttyp6    andrea.xxxxxxxxx Mon Jun 29 10:01   still logged in
neo       ttyp7    andrea.xxxxxxxxx Fri Jun 26 09:29 - 18:13  (08:44)
hwr       ftp      tp70.rz.xxxxxxxx Wed Jun 24 16:48 - 17:08  (00:19)

wtmp begins Wed Jun 24 16:48 

	
>Fix:

Hm. write to wtmp.0.gz :-)
	
>Audit-Trail:
>Unformatted: