UTMP(5)

NAME

utmp, wtmp, btmp − utmp, wtmp, btmp entry format

HP-UX COMPATIBILITY

Level: HP-UX/STANDARD

Origin: System V and UCB

SYNOPSIS

#include <sys/types.h>
#include <utmp.h>

DESCRIPTION

These files, which hold user and accounting information for such commands as last(1), who(1), write(1), and login(1), have the following structure as defined by <utmp.h>:

#defineUTMP_FILE"/etc/utmp"
#defineWTMP_FILE"/etc/wtmp"

#defineut_nameut_user

structutmp
{
charut_user[8];/∗ User login name ∗/
charut_id[4];/∗ /etc/inittab id (usually line #) ∗/
charut_line[12];/∗ device name (console, lnxx) ∗/
shortut_pid;/∗ process id ∗/
shortut_type;/∗ type of entry ∗/
structexit_status {
shorte_termination;/∗ Process termination status ∗/
shorte_exit;/∗ Process exit status ∗/
} ut_exit;/∗ The exit status of a process
∗ marked as DEAD_PROCESS. ∗/
time_tut_time;/∗ time entry was made ∗/
};

/∗ Definitions for ut_type ∗/
#defineEMPTY 0
#defineRUN_LVL 1
#defineBOOT_TIME 2
#defineOLD_TIME 3
#defineNEW_TIME 4
#defineINIT_PROCESS 5 /∗ Process spawned by "init" ∗/
#defineLOGIN_PROCESS 6 /∗ A "getty" process waiting for login ∗/
#defineUSER_PROCESS 7 /∗ A user process ∗/
#defineDEAD_PROCESS 8
#defineACCOUNTING 9
#defineUTMAXTYPE ACCOUNTING /∗ Largest legal value of ut_type ∗/
/∗ Special strings or formats used in the "ut_line" field when ∗/
/∗ accounting for something other than a process ∗/
/∗ No string for the ut_line field can be more than 11 chars + ∗/
/∗ a NULL in length ∗/

#defineRUNLVL_MSG "run−level %c"
#defineBOOT_MSG "system boot"
#defineOTIME_MSG "old time"
#defineNTIME_MSG "new time"

Ut_name is valid for login entries only; otherwise the first character is null. There are logout entries in both utmp and wtmp. In utmp, these entries refer to terminals that are not currently logged in; in wtmp, they record history. File btmp contains bad login entries for each invalid logon attempt.

Note that wtmp and btmp tend to grow without bound, and should be checked regularly. Information that is no longer useful should be removed periodically to prevent it from becoming too large.

FILES

/etc/utmp
/etc/wtmp
/etc/btmp

Museum