On Thu, Jun 29, Bernhard M. Wiedemann via openSUSE Factory wrote:
On 29/06/2023 00.45, Bernhard Voelker wrote:
The commands `users` and `who` from the coreutils package may use wtmp:
strace -e file who 2>&1 | grep tmp
shows on Leap, that they both use /var/run/utmp
while `last` and `lslogins` use /var/log/wtmp to have data from before the boot.
What he did mean was "strace -e file who /var/log/wtmp 2>&1 | grep tmp" execve("/usr/bin/who", ["who", "/var/log/wtmp"], 0x7fffb48358f8 /* 103 vars */) = 0 access("/var/log/wtmpx", F_OK) = -1 ENOENT (Datei oder Verzeichnis nicht gefunden) openat(AT_FDCWD, "/var/log/wtmp", O_RDONLY|O_CLOEXEC) = 3 Only question is, why who tries to use /var/log/wtmpx if I specify /var/log/wtmp? Seems like a developer wanted to be too clever :( Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect, Future Technologies SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nuernberg, Germany Managing Director: Ivo Totev, Andrew Myers, Andrew McDonald, Martje Boudien Moerman (HRB 36809, AG Nürnberg)