>> No, that way has many disadvantages, e.g.:
["that way" is recording IP addresses in (eg) utmp, and doing
address->name lookups at the time of printing.]

>> 1.) Reverse resolving is not always possible.
> Sorry I disagree.  ANY host on the internet should have reliable
> reverse DNS lookups,

I agree that this should be the case.  However, (a) it often isn't,
regardless of whether it should or not, and (b) what if the machine
isn't on the Internet at the time "last" is run?  Obviously, it must
have been at the time the login occurred, but for hosts with
non-full-time connectivity it may not be so at the time last is run.

Personally, I say record the first 32 or whatever characters of the
name and let the admin go to the tcp-wrappers logs if there's some need
to see more than that.

>> 2.) IP address assignments may change.
> What has this to do with anything?

Would you rather see the name that corresponded to the address at the
time of the connect or the name that corresponds to that address now?

For example, at work we've been changing a whole lot of machines'
addresses over the past two weeks.  Many address that were valid,
including a .in-addr.arpa PTR record, three weeks ago no longer exist
(no machine, no PTR record, nothing) now; if you had recorded one of
those IP addresses then, but not looked up the name until now, your
lookup would find no information.

					der Mouse

			    mouse@collatz.mcrcim.mcgill.edu