bin/39444: in last(1), an empty wtmp "begins" now

[dholland%eecs.harvard.edu@localhost]

>Number:         39444
>Category:       bin
>Synopsis:       in last(1), an empty wtmp "begins" now
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Mon Sep 01 04:15:00 +0000 2008
>Originator:     David A. Holland <dholland%eecs.harvard.edu@localhost>
>Release:        NetBSD 4.99.72 (20080831)
>Organization:
>Environment:
System: NetBSD valkyrie 4.99.72 NetBSD 4.99.72 (VALKYRIE) #31: Sun Aug  3 
18:48:19 EDT 2008  root@valkyrie:/usr/src/sys/arch/amd64/compile/VALKYRIE amd64
Architecture: amd64
Machine: x86_64
>Description:

When you run last(1), it finishes up by printing the time it's reached
back to, like this:

        wtmpx begins Sun Aug 31 2008 23:58:33

If wtmp is empty because nobody has logged in or out since the last
time wtmp was rotated, it prints just the timestamp. The problem: the
timestamp is $NOW, which is misleading, rather than the mtime of the
empty wtmp file, which reflects when wtmp was rotated and thus when
the wtmp actually began.

It is particularly annoying if you bring up an idle shell window to
check a system for unwanted activity, because then you have to go look
in /var/log to see if you need to also check wtmp.0.

>How-To-Repeat:

Stay logged in for a while, then run last.

>Fix:

Should be trivial, except that the code in usr.bin/last is failing to
make sense to me.