Cockpit and insights-client files in /etc/motd/ rise above others on pam_motd message

Why are cockpit and insights-client rise above others? /etc/motd rise above everything, but from the contents of the /etc/motd.d/ directory, those two are always pushed over the others. The only obvious difference is that they are symlinks, but I also tested a symlink called air and it had no effect. Normally pam_motd messages work like this.

[root@localhost ~]# ls -l /etc/motd.d
total 4
-rw-r--r--. 1 root root  4 Oct 30 15:08 air
lrwxrwxrwx. 1 root root 17 Dec 14  2021 cockpit -> /run/cockpit/motd
lrwxrwxrwx. 1 root root 41 Dec 14  2021 insights-client -> /etc/insights-client/insights-client.motd
[root@localhost ~]# ssh user@localhost
user@localhost's password: 
Activate the web console with: systemctl enable --now cockpit.socket

This system is not registered to Red Hat Insights. See
To register this system, run: insights-client --register

Last login: Sun Oct 30 15:04:16 2022 from 
[user@localhost ~]$

Do anyone have any ideas?

Seems to work fine on mine:

[root@rocky9 ~]# ls /etc/motd.d/ -lh
total 4.0K
-rw-r--r--. 1 root root  9 Oct 31 13:59 air
lrwxrwxrwx. 1 root root 41 Oct 31 13:59 insights-client -> /etc/insights-client/insights-client.motd

[root@rocky9 ~]# 
Connection to rocky9 closed.

[ian@elise ~]$ ssh rocky9

Test air
Register this system with Red Hat Insights: insights-client --register
Create an account or view all your systems at

Did you change anything else on your system relating to motd maybe this is why the ordering is different? Mine is default rocky9 install and works fine.

As some extra info, Rocky 8 for example seems to ignore the order of files and I believe it goes by date order. I created a few files, eg:


The order they were created was:


Insights with test1, air with test2, 01-rocky with test3 and 02-rocky with test4. Assuming filename ordering, then that should have meant:


However, it came out:


hence seems to be date ordering. On Rocky 9 though it works as per filename ordering, as my previous post shows when I tried to replicate.

You didn’t mention what version of Rocky, so am assuming Rocky 9 because insights-client on Rocky 8 doesn’t create /etc/motd.d files, and the directory also doesn’t exist on Rocky 8 by default, but it will work when created albeit the caveat that I mentioned.

If you are using Rocky 9, then I’m not sure why it works for me, and not for you. I can only think perhaps something has been changed on your system causing it to work differently.

You are right @iwalker

The code in PAM 1.3.1 in Rocky 8 uses readdir(3) without sorting.

       The  order in which filenames are read by successive calls to readdir() depends on the filesystem imple‐
       mentation; it is unlikely that the names will be sorted in any fashion.

I would guess that the inodes might play a role.

motd.d in PAM 1.5.1 in Rocky 9 is sorted by filename. It is definitely implemented in the code and mentioned in the pam_motd man page:

       Files in the directories listed above are displayed in lexicographic order by name. Moreover, the files are filtered by reading them with the credentials
       of the target user authenticating on the system.
1 Like

Thanks @iwalker and @olista! :slight_smile: