login.c that is provided by util-linux does not use
/var/log/btmp. It also provides last and last.1 which are
consistent with this.
However, SysVinit also provides last, last.1 and lastb which
do expect to use /var/log/btmp. This is the version that is
actually found in /usr/bin/last.
This means that lastb is effectively not compatible with
login on Redhat as installed by default. The major issue is
that last.1 is effectively incorrect. Though it does
discribe the correct behavior of last, it describes
incorrect behavior for login.
I recommend that you remove last* from SysVinit. Ideally a
replacement for lastb would read /var/log/secure.
I asked about this half a year or so ago on the mailing list,
and would still like to see a solution.
Preferrably when there is a log of failed connections and lastb exists
Cristian, how are we going to resolve this for 6.0?
Should be fixed in util-linux-2.9o-6.