Thanks, pam is running it is pam that is sending the info try editing /etc/pam.d/sshd although consult the pam docu or man page before if you don't know your way around pam that well. These files are only updated based on entries created from a terminal session, or an X session.

wtmp not updating-87

#define UT_UNKNOWN 0 #define RUN_LVL 1 #define BOOT_TIME 2 #define NEW_TIME 3 #define OLD_TIME 4 #define INIT_PROCESS 5 #define LOGIN_PROCESS 6 #define USER_PROCESS 7 #define DEAD_PROCESS 8 #define ACCOUNTING 9 #define UT_LINESIZE 12 #define UT_NAMESIZE 32 #define UT_HOSTSIZE 256 struct exit_status ; struct utmp ; /* Backwards compatibility hacks.

*/ #define ut_name ut_user #ifndef _NO_UT_TIME #define ut_time ut_tv.tv_sec #endif #define ut_xtime ut_tv.tv_sec #define ut_addr ut_addr_v6[0] This structure gives the name of the special file associated with the user's terminal, the user's login name, and the time of login in the form of time(2).

If possible, I would like to retain reboot information and maybe other selected data.

It cleans up our filesystems and has knowledge of some types of system files, like wtmp and so forth so you can keep by date or other information in those files." id="ctl00_m_m_i_ctl00_gr_ctl03_bestanswerbody" class="textarea-bestanswerhidden" name="bestanswerbody" answerbody Id="4584176" / We use a free shell script utility called "tidysys". Z && > /var/adm/wtmp" id="ctl00_m_m_i_ctl00_gr_ctl05_bestanswerbody" class="textarea-bestanswerhidden" name="bestanswerbody" answerbody Id="4584230" / #!

In Linux/Unix operating systems everything is logged some where.

Most of the system logs are logged in to /var/log folder.

If it is found, the timestamp of the last time the user logged in, the terminal line, and the hostname are written to the standard output (provided the login is not “quiet”; see login(1)).

The login(1) program then records the new login time in the lastlog file.

String fields are terminated by '

Most of the system logs are logged in to /var/log folder.

If it is found, the timestamp of the last time the user logged in, the terminal line, and the hostname are written to the standard output (provided the login is not “quiet”; see login(1)).

The login(1) program then records the new login time in the lastlog file.

String fields are terminated by '[[

Most of the system logs are logged in to /var/log folder.If it is found, the timestamp of the last time the user logged in, the terminal line, and the hostname are written to the standard output (provided the login is not “quiet”; see login(1)).The login(1) program then records the new login time in the lastlog file.String fields are terminated by '\0' if they are shorter than the size of the field.The first entries ever created result from (8) cleans up utmp by setting ut_type to DEAD_PROCESS, clearingut_user, ut_host, and ut_time with null bytes for each record which ut_type is not DEAD_PROCESS or RUN_LVL and where no process with PID ut_pid exists.Warning: utmp must not be writable, because many system programs (foolishly) depend on its integrity.

||

Most of the system logs are logged in to /var/log folder.

If it is found, the timestamp of the last time the user logged in, the terminal line, and the hostname are written to the standard output (provided the login is not “quiet”; see login(1)).

The login(1) program then records the new login time in the lastlog file.

String fields are terminated by '\0' if they are shorter than the size of the field.

The first entries ever created result from (8) cleans up utmp by setting ut_type to DEAD_PROCESS, clearingut_user, ut_host, and ut_time with null bytes for each record which ut_type is not DEAD_PROCESS or RUN_LVL and where no process with PID ut_pid exists.

Warning: utmp must not be writable, because many system programs (foolishly) depend on its integrity.

||

Most of the system logs are logged in to /var/log folder.

If it is found, the timestamp of the last time the user logged in, the terminal line, and the hostname are written to the standard output (provided the login is not “quiet”; see login(1)).

The login(1) program then records the new login time in the lastlog file.

String fields are terminated by '\0' if they are shorter than the size of the field.

]]' if they are shorter than the size of the field.

' if they are shorter than the size of the field.