NAME

utmp, wtmp, lastlog, usracct − login records

SYNOPSIS

#include <utmp.h>

DESCRIPTION

The utmp file records information about who is currently using the system.  The file is a sequence of entries with the following structure declared in the include file:

/∗@(#)utmp.h 1.2 86/10/07 SMI; from UCB 4.2 83/05/22∗/
 /∗
 ∗ Structure of utmp and wtmp files.
 ∗
 ∗ Assuming the number 8 is unwise.
 ∗/
struct utmp {
charut_line[8];/∗ tty name ∗/
charut_name[8];/∗ user id ∗/
charut_host[16];/∗ host name, if remote ∗/
longut_time;/∗ time on ∗/
};
 /∗
 ∗ This is a utmp entry that does not correspond to a genuine user
 ∗/
#define nonuser(ut) ((ut).ut_host[0] == 0 && strncmp((ut).ut_line, "tty", 3) == 0 && ((ut).ut_line[3] == ’p’  || (ut).ut_line[3] == ’q’ || (ut).ut_line[3] == ’r’))

This structure gives the name of the special file associated with the user’s terminal, the user’s login name, and the time of the login in the form of time(3C).

The wtmp file records all logins and logouts.  A null user name indicates a logout on the associated terminal.  Furthermore, the terminal name ‘~’ indicates that the system was rebooted at the indicated time; the adjacent pair of entries with terminal names ‘|’ and ‘}’ indicate the system-maintained time just before and just after a date command has changed the system’s idea of the time. 

wtmp is maintained by login(1) and init(8). Neither of these programs creates the file, so if it is removed, record-keeping is turned off.  It is summarized by ac(8).

/usr/adm/wtmp is appened to whenever a user logs in or out, and should be truncated periodically. 

The lastlog file records the most recent login-date for every user logged in.  When reporting (and updating) the most recent login date, login(1) performs an to a byte-offset in /usr/adm/lastlog corresponding to the userid.  Because the count of userids may be high, whereas the number actual users may be small within a network environment, the bulk of this file may never be allocated by the file system even though an offset may appear to be quite large.  Although ls may show it to be large, chances are that this file need not truncated.  du(1V) will report the correct (smaller) amount of space actually allocated to it.

The usracct file keeps login records in an older format. 

FILES

/etc/utmp
/usr/adm/wtmp
/usr/adm/lastlog
/usr/adm/usracct

SEE ALSO

login(1), init(8), who(1), ac(8)

Sun Release 3.5  —  Last change: 4 April 1986