utmp(4) — File Formats
NAME
utmp, wtmp − Login records
SYNOPSIS
#include <utmp.h>
DESCRIPTION
The utmp file records information about who is currently using the system. The file is a sequence of entries with the following structure declared in the include file:
struct utmp
{
char ut_user[32] ; /∗ User login name ∗/
char ut_id[14] ; /∗ /etc/inittab id-IDENT_LEN in init ∗/
char ut_line[32] ; /∗ device name (console, lnxx) ∗/
short ut_type ; /∗ type of entry ∗/
pid_t ut_pid ; /∗ process id ∗/
struct exit_status
{
short e_termination ; /∗ Process termination status ∗/
short e_exit ; /∗ Process /∗ time
ut_exit ; /∗ The exit status of a process
∗ marked as DEAD_PROCESS.
∗/
time_t ut_time ; /∗ time entry was made ∗/
char ut_host[64]; /∗ host name same as MAXHOSTNAMELEN ∗/
} ;
This structure gives the name of the special file associated with the user’s terminal, the user’s login name, and the time of the login in the form of time(3). The ut_type field is the type of entry, which can specify several symbolic constant values. The symbolic constants are defined in the /usr/include/utmp.h header file.
The wtmp file records all logins and logouts. A null user name indicates a logout on the associated terminal. A terminal referenced with a tilde (~) indicates that the system was rebooted at the indicated time. The adjacent pair of entries with terminal names referenced by a vertical bar (|) or a right brace (}) indicate the system-maintained time just before and just after a date command has changed the system’s time frame.
The wtmp file is maintained by login(1) and init(8). Neither of these programs creates the file, so, if it is removed, record keeping is turned off. See ac(8) for information on the file.
FILES
/usr/include/utmp.h
/var/adm/utmp
/var/adm/wtmp