Duplicate "Last login" info printed

[Andrew Ruch]

Hello,

When I log into my RHEL 6.6 system, I have two "Last login" lines
printed. I know one of them comes from the following line (which I
added):

session  required  pam_lastlog.so  showfailed

Where does the other line come from? I searched /etc/pam.d/ and the
lastlog module is not used anywhere else. Is it from one of the other
PAM modules?

Thanks,
Andrew Ruch