Re: Y2038-safe replacements for utmp/wtmp and lastlog

[Vincent Lefevre]

On 2024-05-08 16:53:53 +0800, Jun MO wrote:
> For last(1) my concern is that it will be helped to keep the original
> last(1) for back-compatibility to read old wtmp files.

I agree, this may be useful. Unfortunately, the current status is
that one cannot have both: installing wtmpdb forces the upgrade of
util-linux to 2.40.1-3 (at least), where "last" is no longer installed.

However, I think that it is better to archive human-readable text files
(generated by "last" in the past) rather than the wtmp files.

I've used the attached script to get both the IP addresses and the
host names with "last" (I don't know whether there's a better way to
get full information).

-- 
Vincent Lefèvre <vinc...@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

#!/usr/bin/env perl

# Output wtmp logs, based on command 'last' from util-linux.
# This command is called twice:
#   1. without the -d option;
#   2. with the -d option to get the host names.

use strict;

my ($proc) = '$Id: lastf 103313 2017-11-06 01:47:30Z vinc17/joooj $'
  =~ /^.Id: (\S+) \d+ / or die;

@ARGV == 1 or $! = 1, die "Usage: $proc <wtmp_file>\n";
-f $ARGV[0] or $! = 1, die "$proc: $ARGV[0] is not a regular file\n";
-r $ARGV[0] or $! = 1, die "$proc: $ARGV[0] is not a readable file\n";

sub rdlog ($@)
  {
    my $file = shift;
    open LAST, '-|', 'last', @_, '-axf', $file
      or die "$proc: can't exec 'last': $!";
    my @t = <LAST>;
    close LAST, or die "$proc: 'last' failed: $!";
    $t[-1] =~ / begins / && $t[-2] eq "\n"
      or $! = 2, die "$proc: bad format";
    return @t;
  }

my @t1 = rdlog $ARGV[0];
my @t2 = rdlog $ARGV[0], '-d';
$#t1 == $#t2 or $! = 1, die "$proc: bad length ($#t1 vs $#t2)\n";
$t1[-1] eq $t2[-1] or die $! = 1, die "$proc: inconsistent last line\n";

foreach my $i (0..$#t1-2)
  {
    $_ = $t1[$i];
    chomp;
    my ($u1) = /^(.){60}/
      or $! = 2, die "$proc: bad format";
    my ($u2,$v2) = $t2[$i] =~ /^(.){60}(.*)$/
      or $! = 2, die "$proc: bad format";
    $u1 eq $u2 or $! = 2, die "$proc: bad format";
    $v2 eq '0.0.0.0' or $_ .= " ($v2)";
    print "$_\n";
  }

print "\n$t1[-1]";