wtmp/last weird behavior

[David Rysdam]

mark <prgrmr at gmail.com> writes:
> What version of Linux is this?   Have you looked through /var/log/messages
> for the corresponding login entries? Try aureport to see what auditd picked
> up for login behavior.

This is Debian 7. I looked in /v/l/m just now and I don't see anything
that looks like a login. Do you have greppable suggestion?

I see a lightdm log, maybe it's so light it fails to log properly...

I don't have auditd running.