3

From the output of last on RHEL5

user3    pts/6        :pts/1:S.0       Sat Feb 26 04:04 - 05:40  (01:35)
user2    pts/7        :0.0             Fri Feb 25 21:32 - 04:53  (07:21)
user1    pts/6        some.domain.com  Fri Feb 25 20:38 - 23:19  (02:41)

To my understanding, the 3rd column tells where the tty session was created from. It's likely that user1 logged in remotely from some.domain.com via SSH, and user2 opened a terminal window in X locally.

But what about user3? It looks like he created pts/6 from pts/1. How does that usually happen? And what does :S.0 mean?

netvope
  • 5,475

1 Answers1

8

My guess is that it's an internal connection through some TTY virtualisation, such as screen

It could be screen running on pts/1 with a single virtual TTY inside it (S.0 - screen window 0) connected to pts/6

Screen is very useful for running things that take a long time - you can detach it from the controlling terminal and close your session and the program keeps running as if your session were still connected. You can then reconnect you session at a later date and carry on from where you left off.

I personally use screen all the time when working on a remote server as it means that if my connection drops I can reconnect my session and continue editing the file I was in as if nothing had happened.

Majenko
  • 32,964