I noticed this behavior on my server today and I'd like to understand more about what's happening.When issuing the w command while ssh'ed into my RHEL 6 server I was attempting to have the FROM field print the hostname rather than the IP of the SSH client. Note that I use 8.8.8.8 for DNS and that resolution of google.com works fine with ping, for example.So I edited /etc/hosts on the SSH server to include an entry for the client. Pinging the client by hostname now works fine, but w still displays the IP address in the FROM field.Simply logging out and logging back in and issuing w again allowed the FROM field to list the SSH client by the hostname I configured in /etc/hosts.My question is, why was the logout/login necessary? What changed or got updated upon logging back in?I'm using bash-4.1.2-33.el6_7.1, the latest available in RHEL 6 base.
Changes to /etc/hosts are not recognized by shell commands until logging out and logging back in
bash;shell
w reads /var/run/utmp to find out who is logged in and where they logged in from.  utmp records are updated when a user logs in or logs out.If there was no DNS or /etc/hosts entry for the IP at the time the user logged in then the hostname field in utmp is left empty by the login process (sshd in this case).When you logged out and logged in again after adding the /etc/hosts entry, sshd performed a lookup on the IP and this time found a hostname, so was able to add the correct data to the hostname field in utmp.see man 5 utmp for details on the file format of /var/run/utmp