Rudder

This is probably a Fusion Inventory issue.

The inventory contains last logged user information from /var/log/wtmp, such as :

      <DATELASTLOGGEDUSER>Mon Jun 23 08:00</DATELASTLOGGEDUSER>
      <LASTLOGGEDUSER>root</LASTLOGGEDUSER>

However, if the /var/log/wtmp file has just been rotated by logrotate, it contains no valid logged users information, and the inventory produces :

      <DATELASTLOGGEDUSER>Wed Jun 25 11:01:40</DATELASTLOGGEDUSER>
      <LASTLOGGEDUSER>wtmp</LASTLOGGEDUSER>

Here the timestamp does not have the same format : it contains seconds, when valid user entries do not.

Up to Rudder 8.2.7 and 8.3.2, this causes the inventory processing on the Rudder server to issue a warning :

2025-06-25 11:02:27+0200 WARN  inventory-processing - Error when parsing date for last user loggin. Awaited format is EEE MMM dd HH:mm, found: Wed Jun 25 11:01:40

This warning corresponds to issue #27067 and is fixed by PR https://github.com/Normation/rudder/pull/6444

However it remains that after logroate of wtmp, the inventory generates some non-significant entries for last user ("wtmp") and a timestamp that contains seconds (rotation timestamp).