Tabular format incompatibility between old "last" implementation and this "last" implementation

[rlee287]

Example lines from wtmp's new "last" implementation, as installed by the wtmpdb package on Ubuntu Oracular:

example1 tty2                          Wed Jan 15 09:32 - still logged in
reboot   system boot  6.11.0-13-generi Wed Jan 15 09:32 - still running

Example lines from the old "last" implementation, as installed by the util-linux package on Ubuntu Noble:

example1 tty2         tty2             Wed Jan 15 08:35   still logged in
example1 seat0        login screen     Wed Jan 15 08:35   still logged in
reboot   system boot  6.8.0-51-generic Wed Jan 15 08:35   still running

Unlike the old "last" implementation, the new one does not include "tty2" twice and thus does not have a constant number of columns per line. This breaks tooling such as, for example, shell scripts that use "awk" with a fixed column number to extract the date column from last --time-format iso.

[thkukuk]

The wtmpdb last output is exactly the one from the last implementation of util-linux:

root     tty1                          Wed Jan 15 22:57 - 22:57  (00:00)
kukuk    pts/26       :0               Sun Jan 12 17:15   still logged in

Since the "tty" field can contain several words (like "system boot" in your example) and the format of the time field is different if the user logged out, I don't see how you can parse that with "awk" reliable anyways.
If Ubuntu has a different output, than they most likely patched their last version.

For parsing the output, best and reliable options are:

• access the sqlite3 database, maybe with libwtmpdb
• implement output in json format like many systemd tools have.

[thkukuk]

wtmpdb last supports now json output, you can use e.g. jq to parse that.