Lastlog contains IP addresses of logins
When I login through ssh as root onto a leap provider, I can see the IP address I connected from in lastlog:
$ lastlog Username Port From Latest root pts/0 217.169.43.74 Wed Dec 10 10:28:00 +0000 2014
In /var/log/auth.log the IP gets replaced by 0.0.0.0.
(from redmine: created on 2014-12-10, relates #1402)