Очередной день открытий.
Может, if ( !strcmp(entry->ut_host, XTTY) )
? ut_line The name of the TTY character device, without the leading /dev/
prefix, corresponding with the device used to facilitate the
user login session. If no TTY character device is used, this
field is left blank. This field is only applicable to entries
of type USER_PROCESS and LOGIN_PROCESS.
ut_host The network hostname of the remote system, connecting to perform
a user login. If the user login session is not performed across
a network, this field is left blank. This field is only appli-
cable to entries of type USER_PROCESS.
В линуксе afaik путевого мана нет.
В солярисе:
char ut_line[32]; /* device name (console, lnxx) */
char ut_host[257]; /* host name, if remote */
Проверочное слово w, смотрим колонку FROM (ut_host)