The utmpx entry done upon logout from ssh does not contain all the fields that
the login record does - this prevents the last command from working properly on
Solaris 8. I have created a patch to correct this (attached below). The problem
with last without this patch exhibits itself when you run "last username" -
entries come up indicating that you are still logged in because the last command
cannot find the logout for that login (it looks for an entry with the same
username, which is not being used in the logout utmpx entries currently). The
patch, which is against 3.0.2p1, merely puts all the same information into the
utmpx entry for both a login and a logout. This bugzilla entry duplicates an
e-mail I sent in in late November, in case this comes up as a duplicate of a
known issue.

--- loginrec.c~ Mon Oct 29 21:50:40 2001
+++ loginrec.c  Tue Jan 29 10:56:59 2002
@@ -701,6 +701,7 @@
        line_stripname(utx->ut_line, li->line, sizeof(utx->ut_line));
        set_utmpx_time(li, utx);
        utx->ut_pid = li->pid;
+       strncpy(utx->ut_name, li->username, MIN_SIZEOF(utx->ut_name,
li->username));
 
        if (li->type == LTYPE_LOGOUT)
                return;
@@ -711,7 +712,6 @@
         */
 
        /* strncpy(): Don't necessarily want null termination */
-       strncpy(utx->ut_name, li->username, MIN_SIZEOF(utx->ut_name,
li->username));
 # ifdef HAVE_HOST_IN_UTMPX
        strncpy(utx->ut_host, li->hostname, MIN_SIZEOF(utx->ut_host,
li->hostname));
 # endif
@@ -942,9 +942,7 @@
 {
        struct utmpx utx;
 
-       memset(&utx, '\0', sizeof(utx));
-       set_utmpx_time(li, &utx);
-       line_stripname(utx.ut_line, li->line, sizeof(utx.ut_line));
+       construct_utmpx(li, &utx);
 # ifdef HAVE_ID_IN_UTMPX
        line_abbrevname(utx.ut_id, li->line, sizeof(utx.ut_id));
 # endif
--- session.c~  Sat Dec  1 18:37:08 2001
+++ session.c   Tue Jan 29 10:56:59 2002
@@ -1866,7 +1866,7 @@
 
        /* Record that the user has logged out. */
        if (s->pid != 0)
-               record_logout(s->pid, s->tty);
+               record_logout(s->pid, s->tty, s->pw->pw_name);
 
        /* Release the pseudo-tty. */
        pty_release(s->tty);
--- sshlogin.c~ Tue May  8 16:33:06 2001
+++ sshlogin.c  Tue Jan 29 10:56:59 2002
@@ -94,11 +94,11 @@
 /* Records that the user has logged out. */
 
 void
-record_logout(pid_t pid, const char *ttyname)
+record_logout(pid_t pid, const char *ttyname, const char *user)
 {
   struct logininfo *li;
 
-  li = login_alloc_entry(pid, NULL, NULL, ttyname);
+  li = login_alloc_entry(pid, user, NULL, ttyname);
   login_logout(li);
   login_free_entry(li);
 }
--- sshlogin.h~ Wed Jul  4 00:46:58 2001
+++ sshlogin.h  Tue Jan 29 10:56:59 2002
@@ -17,7 +17,7 @@
 void
 record_login(pid_t, const char *, const char *, uid_t,
     const char *, struct sockaddr *);
-void   record_logout(pid_t, const char *);
+void   record_logout(pid_t, const char *, const char *);
 u_long         get_last_login_time(uid_t, const char *, char *, u_int);
 
 #endif