Thanks, Gavin. Problem solved! :)

in my /etc/pam.d/login :

# Prints the last login info upon succesful login
# (Replaces the `LASTLOG_ENAB' option from login.defs)
session    optional   pam_lastlog.so

and your link at die.net had me append "noupdate showfailed" as switches

session    required   pam_lastlog.so noupdate showfailed

so I cut and pasted it to my /etc/pam.d/sshd and /etc/pam.d/su

had to reboot my box ... and it works like a charm.

Thanks to all.