Re: [RFC] Modernizing Linux authentication logs (lastlog, btmp, utmp, wtmp) with SQLite

Thorsten Kukuk <[email protected]> Fri, 10 Apr 2026 14:38:36 +0200
Newsgroups org.kernel.vger.audit,org.kernel.vger.linux-api,org.kernel.vger.linux-kernel
Message-ID <CABMvmLuyB1t2WJrDsFS8Jo0Mx19b3zZ-BA0Xe8JaCdJhouZ63w@mail.gmail.com>
On Fri, Mar 13, 2026 at 7:51 PM Florian Weimer <[email protected]> wrote:
>
> * Roman Bakshansky:
>
> > The full RFC, including preliminary database schemas and API drafts,
> > is available in the discussion repository:
> >
> >      https://github.com/bakshansky/linux-auth-logs
>
> I don't understand how SQLite (without a daemon) addresses the locking
> issue.  WAL mode still uses fcntl locking.

It doesn't, that's why wtmpdb is using a daemon for this.
With pam_lastlog2, the messages aren't important or reliable enough to
justify the overhead. But if you want, you would need to introduce a
daemon, too.

Regards,
Thorsten

-- 
Thorsten Kukuk, Distinguished Engineer, Future Technologies
SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461
Nuernberg, Germany
Geschäftsführer: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB
36809, AG Nürnberg)