/usr/bin/last is using UTC rather than local time for login

[M. Weinberg]

I upgraded from 14.04 to 14.10. When I run /usr/bin/last, which relies on /var/log/wtmp, I get the following output (note: I replaced my login name with XXXX):

XXXX pts/8 :0 Thu Oct 2 20:40 still logged in
XXXX pts/2 :0 Thu Oct 2 20:36 still logged in
XXXX pts/2 :0 Thu Oct 2 18:55 - 20:30 (01:34)
XXXX :0 :0 Thu Oct 2 18:54 still logged in
reboot system boot 3.16.0-20-generi Thu Oct 2 22:54 - 20:41 (-2:-12)
XXXX pts/9 :0 Thu Oct 2 18:38 - 18:52 (00:14)
XXXX pts/0 :0 Thu Oct 2 18:35 - 18:53 (00:17)

Note that for the XXXX login, the session's start and stop time are both shown in local time. However, for the reboot line, the start time is shown in UTC (i.e. Greeenwich) time and the current time is shown in local time, which gives rise to the negative elapsed time.

I tried emptying the /var/log/wtmp file and rebooting. No luck.

Possibly wtmp is being written to before the time zone can be established. My time zone is EDT (US/Eastern, same time zone as New York).

When I run the linux "date" command, the time zone is shown correctly.

ProblemType: Bug
DistroRelease: Ubuntu 14.10
Package: sysvinit-utils 2.88dsf-41ubuntu18
ProcVersionSignature: Ubuntu 3.16.0-20.27-generic 3.16.3
Uname: Linux 3.16.0-20-generic x86_64
NonfreeKernelModules: wl
ApportVersion: 2.14.7-0ubuntu2
Architecture: amd64
CurrentDesktop: Unity
Date: Thu Oct 2 20:38:10 2014
EcryptfsInUse: Yes
InstallationDate: Installed on 2014-04-20 (165 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Release amd64 (20140417)
SourcePackage: sysvinit
UpgradeStatus: Upgraded to utopic on 2014-10-02 (0 days ago)

[Steve Langasek (vorlon)]

> I upgraded from 14.04 to 14.10.

Do you mention this because this is a new problem that didn't exist in previous releases?

Since /var/log/wtmp's structure doesn't include timestamps, all times in this file must be written in UTC. Is your system clock set in local time instead of in UTC?

Checking recent reboots on my 14.10 system with 'utmpdump /var/log/wtmp.1' shows correct times:

[2] [00000] [~~ ] [reboot ] [~ ] [3.16.0-16-generic ] [0.0.0.0 ] [Mon Sep 22 15:00:50 2014 PDT]
[1] [00050] [~~ ] [runlevel] [~ ] [3.16.0-16-generic ] [0.0.0.0 ] [Mon Sep 22 15:00:50 2014 PDT]

Confirmed against /var/log/kern.log that this is the time of the boot:
  Sep 22 15:00:49 virgil kernel: [ 0.000000] Initializing cgroup subsys cpuset

last -f /var/log/wtmp.1 shows similarly correct information:

reboot system boot 3.16.0-16-generi Mon Sep 22 15:00 - 12:32 (10+21:31)

So I can't reproduce the problem you're describing.

[M. Weinberg (mrwein56)]

Yes, this is a new problem that didn't exist in any prior releases of Ubuntu, nor any other distribution of Linux or Unix that I have used. I ran utmpdump as you described; all entries looked correct.

As far as I know, my system's clock is set in UTC:
$ date
Fri Oct 3 16:30:08 EDT 2014
$ date -u
Fri Oct 3 20:30:09 UTC 2014

I will do the following and report back:
1. Wipe out wtmp file and reboot. I noticed that an update yesterday included something about time zones.
2. Do a clean install to see if that makes a difference. The problem may have been due to upgrading from 14.04 to 14.10 rather than doing a clean install.

Thanks for looking at this so quickly, and telling me about utmpdump. I didn't know the command existed.

[M. Weinberg (mrwein56)]

I ran "cat /dev/null > /var/log/wtmp", rebooted and then ran utmpdump /var/log/wtmp. Results are attached, with XXXX instead of my login name. Results look odd, because the time stamps are always reported to be EDT, but seem to flip back and forth between EDT and UTC.

[nabice (nabice)]

The problem still exists.
I upgraded from 14.04 to 16.04.