[CentOS] logging in

Tue Jan 30 18:26:30 UTC 2018
m.roth at 5-cent.us <m.roth at 5-cent.us>

This is.... odd.

We're seeing a *lot* of
sshd[8400]: Timeout, client not responding.
So I'm trying to find out whose client is having issues. Trying to figure
that, after processes are gone, I tried looking in lastlog, which is where
it gets odd. lastlog shows root coming in, and it shows a security account
coming in... years ago.

I see one of our users logging in a goodly number of times... but lastlog
doesn't show him. I just logged in as myself, no password, using keys...
and lastlog doesn't show me, or my manager, or anyone else.

Does anyone have any idea why lastlog's not recording *all* logins?