user not showing up in 'last' (wtmp)

Hi,

Sometimes users don't show up in the 'last' command although they usually do.

Usually the 'last' command gives something like this (usernames and IP addresses sanitized):

[santitized]# last
root     pts/2        somewhere Sat Jun  2 12:50   still logged in   
user1 ppp0         2.22.444.555    Sat Jun  2 10:55   still logged in   
user2 ppp7         3.44.555.666      Sat Jun  2 09:05   still logged in   
user3 ppp0         4.55.666.777      Sat Jun  2 08:49 - 09:18  (00:28)    
 


But sometimes a user is simply not entered into this at all (or looses its entry). 
When I check the messages file for this username I get a normal entry like this:

May 30 08:38:44 dk2 pppd[20678]: Plugin radius.so loaded.
May 30 08:38:44 dk2 pppd[20678]: RADIUS plugin initialized.
May 30 08:38:44 dk2 pppd[20678]: Plugin radattr.so loaded.
May 30 08:38:44 dk2 pppd[20678]: RADATTR plugin initialized.
May 30 08:38:44 dk2 pppd[20678]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
May 30 08:38:44 dk2 pppd[20678]: pptpd-logwtmp: $Version$
May 30 08:38:44 dk2 pppd[20678]: pppd 2.4.4 started by root, uid 0
May 30 08:38:44 dk2 pppd[20678]: Using interface ppp4
May 30 08:38:44 dk2 pppd[20678]: Connect: ppp4 <--> /dev/pts/5
May 30 08:38:47 dk2 pppd[20678]: Unsupported protocol 'IPv6 Control Protovol' (0x8057) received
May 30 08:38:47 dk2 pppd[20678]: MPPE 128-bit stateless compression enabled
May 30 08:38:49 dk2 pppd[20678]: Cannot determine ethernet address for proxy ARP
May 30 08:38:49 dk2 pppd[20678]: local  IP address 10.5.1.1
May 30 08:38:49 dk2 pppd[20678]: remote IP address 10.5.1.6May 30 08:38:49 dk2 pppd[20678]: pptpd-logwtmp.so ip-up ppp4 user4 111.222.333.444 
Then I check the ppp4 interface which is up and looks normal. 
Also the pppd process 20678 is running. 
And when I tcpdump the interface (ppp4) then I can see trafic. So obviously the user is still connected. 
HOWEVER: When I ping the remote IP (10.5.1.6) then I get no response (I normally get a response from remote addresses). Not sure if this has any impact.


Anybody know why this user is not logged in the wtmp file?
I guess it's the pptpd-logwtmp.so plugin that is failing, but have others experienced this?


Regards,
Tobias

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Poptop-server mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/poptop-server