| Summary: | last lists user as "gone -- no logout" when user still logged in | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | w unruh <unruh> |
| Component: | RPM Packages | Assignee: | All Packagers <pkg-bugs> |
| Status: | REOPENED --- | QA Contact: | |
| Severity: | minor | ||
| Priority: | Normal | CC: | lewyssmith, mageia, ouaurelien, tmb |
| Version: | 8 | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7TOO | ||
| Source RPM: | util-linux-2.36.1-5.mga8.src.rpm, util-linux-2.33.2-1.1.mga7.src.rpm | CVE: | |
| Status comment: | |||
|
Description
w unruh
2020-07-30 00:40:48 CEST
Thank you for reporting this - you say an old problem. In fact I do not think it is a bug. The 'last' manpage does not explain the display. I see for myself, now, logged in only on tty1 (the graphical interface) for the current boot: $ last lewis tty1 :0 Fri Jul 31 20:42 still logged in lewis console :0 Fri Jul 31 20:42 gone - no logout reboot system boot 5.6.14-desktop-2 Fri Jul 31 20:39 still running and for the previous boot: lewis tty1 :0 Thu Jul 30 07:47 - 11:40 (03:53) lewis console :0 Thu Jul 30 07:47 - down (03:53) reboot system boot 5.6.14-desktop-2 Thu Jul 30 07:45 - 11:40 (03:55) I do not know what 'console' means here, but your SSH login has the same treatment. Does it also show 'down' for previous logins? So what you are seeing looks normal, if cryptic. I would persue this on a forum if it bothers you. Can we close this, with no offence? Re-open it if you really want to, but it is likely to be an upstream affair. CC:
(none) =>
lewyssmith *** Bug 28403 has been marked as a duplicate of this bug. *** On the duplicate bug 28403 I noted the same sort of thing for Mageia 8. I still think it is 'normal', if unexplained, behaviour. This tutorial page: https://www.howtoforge.com/linux-last-command/ shows the "gone - no logout" line in its examples; but with no explanation! Same with: https://linuxize.com/post/last-command-in-linux/ https://www.baeldung.com/linux/last-command says: "The 5th column shows the logout time. It could be the following values: a timestamp – if the user has logged out still running- if the system boot is still running still logged in – if the user is still logged in down – the system is shut down normally crash – if there is no logout entry in the /var/log/wtmp file; this usually means the system crashed" So this remains a mystery, yet because it is shown in some example pages - albeit with no explanation - must be 'normal'. The man page makes no reference. Await Aurélien's view, but I think we must close this again. It does not look like a Mageia bug. CC:
(none) =>
ouaurelien Mageia 8 x86_64 Plasma $ last aurelien pts/0 :0 Tue Feb 23 16:43 still logged in aurelien pts/0 :0 Tue Feb 23 15:19 - 15:40 (00:20) aurelien pts/0 :0 Tue Feb 23 15:19 - 15:19 (00:00) aurelien tty1 :0 Tue Feb 23 15:19 still logged in reboot system boot 5.10.16-desktop- Tue Feb 23 15:17 still running aurelien pts/2 :0 Tue Feb 23 14:48 - 15:15 (00:27) aurelien pts/1 :0 Tue Feb 23 14:38 - 15:14 (00:36) aurelien pts/1 :0 Tue Feb 23 14:09 - 14:34 (00:25) aurelien pts/1 :0 Tue Feb 23 10:59 - 14:06 (03:06) aurelien pts/1 :0 Tue Feb 23 10:53 - 10:57 (00:04) wtmp commence Tue Feb 23 10:22:09 2021 As you can see, I don't have "gone - no logout" but this system was not booted since two days ago. And wtmp starts only on a cold boot. I don't use ssh at my home. I should test this. Note: aurelien pts/1 :0 Tue Feb 23 10:59 - 14:06 (03:06) Such lines are for Konsole. Also weird things can happen if the wtmp file gets rotated during a login session. Re comment 5: But this is certainly not happening in the cases I outlined. I logged in well after the rotation, and it gave me that "gone" message, when I was certainly not gone-- I was running programs (including last) in that ssh session. Here is another example. The machine has not been rebooted for at least 4 days, but the latest ssh login is still listed as "gone". There certainly is no logout-- I am still logged in, but I am also certainly not "gone". unruh pts/2 ::1 Wed Feb 24 17:32 gone - no logout unruh pts/2 ::1 Wed Feb 24 14:58 - 16:04 (01:05) unruh pts/2 ::1 Tue Feb 23 16:14 - 16:14 (00:00) unruh pts/2 ::1 Tue Feb 23 16:12 - 16:14 (00:02) daniel pts/1 :0 Tue Feb 23 11:06 still logged in daniel tty1 :0 Tue Feb 23 11:06 still logged in unruh pts/2 ::1 Tue Feb 23 08:57 - 09:01 (00:04) unruh pts/2 ::1 Tue Feb 23 08:49 - 08:51 (00:01) unruh pts/2 ::1 Mon Feb 22 18:58 - 21:23 (02:24) daniel pts/1 :0 Mon Feb 22 17:36 - 11:06 (17:30) daniel pts/1 :0 Mon Feb 22 10:19 - 12:39 (02:19) daniel tty1 :0 Mon Feb 22 10:19 - 11:06 (1+00:46) unruh pts/1 ::1 Mon Feb 22 08:13 - 08:23 (00:09) unruh pts/1 ::1 Mon Feb 22 08:10 - 08:12 (00:01) unruh pts/1 ::1 Mon Feb 22 06:21 - 06:26 (00:04) Now as can be seen, there are two users logged in. Is that influencing the message-- in aurelian's case there is only one. Nope, not the case. On another machine (again Mga7) which has been up for about 6 months, and I am the only one logged in, I get unruh pts/4 75.155.***.*** Wed Feb 24 09:37 gone - no logout unruh pts/0 75.155.***.*** Wed Feb 24 09:16 gone - no logout Oh, I did not catch it before, what terminal app are you using? Because of this line: unruh pts/2 ::1 Wed Feb 24 17:32 gone - no logout This is a pseudo-terminal session under a forwarded X environment over a SSH connection. Also, ::1 is ipv6 address for localhost. So, is that a SSH connection, does not it? So, your SSH connection was lost by an improper clean up. Did you put the client system to sleep? (Note also that this: daniel pts/1 :0 Tue Feb 23 11:06 still logged in daniel tty1 :0 Tue Feb 23 11:06 still logged in means for local user connected to seat0 and a X session running on tty1 with screen :0 ). Yes, one hypothsis is that the problem is the ssh tunnel. However the last example is via a direct regular ssh connection from a remote machine to a different Mga7 machine. Here is that second machine when I also have a connetion from the machine to itself (ssh machinename on that machine itself) unruh pts/7 142.103.xxx.xxx Wed Feb 24 11:19 gone - no logout unruh pts/6 142.103.xxx.xxx Wed Feb 24 11:14 gone - no logout unruh pts/4 75.155.xxx.xxx Wed Feb 24 10:42 gone - no logout unruh pts/0 75.155.xxx.xxx Wed Feb 24 10:24 gone - no logout unruh pts/4 75.155.xxx.xxx Wed Feb 24 09:37 - 10:18 (00:41) unruh pts/0 75.155.xxx.xxx Wed Feb 24 09:16 - 09:56 (00:39) Also, those ssh connections are NOT lost. All are active and working. It should say "still Loged in" since I am still logged in and the ssh connection is working in all of those cases. Those connections are NOT gone. They are active and working. So this is awful and there is a clearly bug here. I wonder if there is no issue with logind/wtmp/pam/systemd/ssh... Will take a look. [Repeated collisions] People all over the place have asked about this, seldom getting a definitive reply, for example: https://linux.debian.devel.narkive.com/USeqH4jp/gone-no-logout "Currently if a user is logged in while logrotate renames the /var/log/wtmp file then the command "last -i -f /var/log/wtmp.1" will give a result such as the following: root pts/0 10.0.0.1 Fri Jan 16 13:17 gone - no logout" https://www.linuxquestions.org/questions/slackware-14/weird-gone-no-logout-in-wtmp-539337/ 'weird "gone no logout" in wtmp [Log in to get rid of this advertisement] I searched a lot on forums for an answer but no luck! When I logout from the console (tty1-6) I sometimes get a "gone - no logout" message in wtmp and the user is not removed from utmp.' https://bugzilla.redhat.com/show_bug.cgi?id=82034 "gone - no logout It says uname :0 Thu Jan 16 17:05 gone - no logout even though I'm still logged in." --------------------------------- A solution? Ah! Further on: "This is a problem in the /etc/X11/gdm/PreSession/Default file. Make sure that the line that runs sessreg has an exec in it" My system /etc/X11/gdm/PreSession/Default has only: PATH="/usr/bin/X11:/usr/X11R6/bin:/opt/X11R6/bin:$PATH" and there is no equivalent /xdm/ file, sometimes cited. No sign of "the sessreg command". More searching: https://www.linuxquestions.org/questions/linux-newbie-8/who-and-w-does-not-display-x-server-session-user-4175527919/ My /etx/X11/xdm/Xstartup calls sessreg. The contents of this Xstartup file is: #!/bin/sh # Register a login (derived from GiveConsole as follows:) # exec /usr/bin/sessreg -a -w /var/log/wtmp -u /var/run/utmp -x /usr/lib/X11/xdm/Xservers -l $DISPLAY -h "" $USER -------------------------------------------- So it is said to be related to rotating wtmp. If we knew exactly the line to put here, we could try it. /etc/X11/gdm/PreSession/Default is provided by 'gdm'; which is committed by different people, so assigning this bug globally. CC'ing tmb & Martin who have tinkered with gdm recently, and might understand this immediately. Assignee:
bugsquad =>
pkg-bugs I do not use gdm. I use sddm. And this only happens sometimes, and on some machines. not always. And this is NOT related to rotating wtmp.
Thomas Backlund
2021-02-24 20:38:54 CET
CC:
thomas.backlund =>
tmb Well I have several display managers, including GDM & SDDM & XDM. Yet this is all (of relevant looking things) I have in: $ ls /etc/X11/ dm/Sessions/ Empty gdm/PreSession/Default as comment 11 xdm/Xsession = #!/usr/bin/bash -login exec /etc/X11/Xsession $* # Xsession ends here Xsession* A long script Xsession.d/ Empty "this is NOT related to rotating wtmp" I did not say it definitely was, only "is said to be". Did you look at those URLs in comment 11 ? Never mind, this is in hand. Two years on and the bug is still there. Here is the top of last command Note that the top entry is the most immediate login that I just 5 seconds ago made. (Mageia 8) Note that in those few seconds no rotating of wtmp occured. I am not sure what "this is in hand" means. (Yes, I did look at those URLS. I do not use gdm and thus no gdm files exit. unruh pts/8 75.155.xxx.xx Wed Jul 5 21:35 gone - no logout unruh pts/8 75.155.xxx.xx Wed Jul 5 21:16 - 21:23 (00:07) unruh pts/7 :0 Wed Jul 5 15:20 still logged in unruh pts/7 142.103.xxx.xx Wed Jul 5 14:37 - 14:46 (00:08) unruh pts/6 :0 Wed Jul 5 14:37 still logged in |