UTMP(4)                              SysV                              UTMP(4)



NAME
     utmp, wtmp - utmp and wtmp entry formats

SYNOPSIS
     #include <sys/types.h>
     #include <utmp.h>

DESCRIPTION
     These files, which hold user and accounting information for such commands
     as who(1), write(1), and login(1), have the following structure as
     defined by <utmp.h>:

     #ifdef apollo
     #define   UTMP_$NAME_SIZE     32   /* size of user and host names in Apollo utmp files */
     #endif

     #define   UTMP_FILE "/etc/utmp"
     #define   WTMP_FILE "/etc/wtmp"
     #define   ut_name   ut_user

     typedef struct {
          unsigned short      family;
          unsigned char  data[14];
     } ut_node_t;

     struct utmp
       {
     #ifdef apollo
          char ut_user[UTMP_$NAME_SIZE] ;    /* User login name */
     #else
          char ut_user[8] ;        /* User login name */
     #endif
          char ut_id[4] ;          /* /etc/lines id(usually line #) */
          char ut_line[12] ;       /* device name (console, lnxx) */
          short ut_pid ;           /* process id */
          short ut_type ;          /* type of entry */
          struct exit_status
            {
              short e_termination ;     /* Process termination status */
              short e_exit ;       /* Process exit status */
            }
          ut_exit ;           /* The exit status of a process
                               * marked as DEAD_PROCESS.
                               */
          time_t ut_time ;         /* time entry was made */
     #ifdef apollo
         char ut_host[UTMP_$NAME_SIZE] ; /* host name, if remote */
     #endif
          struct entry_loc         /* new fields for node and boot node info */
          {    ut_node_t node;
               ut_node_t boot_node;
          } ut_loc;
       } ;

     /*   Definitions for ut_type                           */

     #define   EMPTY          0
     #define   RUN_LVL        1
     #define   BOOT_TIME 2
     #define   OLD_TIME  3
     #define   NEW_TIME  4

     #define   INIT_PROCESS   5    /* Process spawned by "init" */
     #define   LOGIN_PROCESS  6    /* A "getty" process waiting for login */
     #define   USER_PROCESS   7    /* A user process */
     #define   DEAD_PROCESS   8
     #define   ACCOUNTING     9

     #define   UTMAXTYPE ACCOUNTING     /* Largest legal value of ut_type */

     /*   Special strings or formats used in the "ut_line" field when */
     /*   accounting for something other than a process.              */
     /*   No string for the ut_line field can be more than 11 chars + */
     /*   a NULL in length.                            */

     #define   RUNLVL_MSG     "run-level %c"
     #define   BOOT_MSG  "system boot"
     #define   OTIME_MSG "old time"
     #define   NTIME_MSG "new time"

WARNINGS
     /etc/utmp can be an unreliable source of login information.  /etc/utmp is
     written by the most recently executed /bin/login, which is not
     necessarily the same as the current login.

FILES
     /etc/utmp
     /etc/wtmp

SEE ALSO
     getut(3C).
     login(1), who(1), write(1) in the SysV Command Reference.