login.c that is provided by util-linux does not use /var/log/btmp. It also provides last and last.1 which are consistent with this. However, SysVinit also provides last, last.1 and lastb which do expect to use /var/log/btmp. This is the version that is actually found in /usr/bin/last. This means that lastb is effectively not compatible with login on Redhat as installed by default. The major issue is that last.1 is effectively incorrect. Though it does discribe the correct behavior of last, it describes incorrect behavior for login. I recommend that you remove last* from SysVinit. Ideally a replacement for lastb would read /var/log/secure.
I asked about this half a year or so ago on the mailing list, and would still like to see a solution. Preferrably when there is a log of failed connections and lastb exists and works...
Cristian, how are we going to resolve this for 6.0?
Should be fixed in util-linux-2.9o-6.