utmp, wtmp - Login records
The utmp file records information about who is currently
using the system. The file is a sequence of utmp entries,
as defined in struct utmp in the utmp.h file.
The utmp structure gives the name of the special file
associated with the user's terminal, the user's login
name, and the time of the login in the form of time(3).
The ut_type field is the type of entry, which can specify
several symbolic constant values. The symbolic constants
are defined in the utmp.h file.
The wtmp file records all logins and logouts. A null user
name indicates a logout on the associated terminal. A
terminal referenced with a tilde (~) indicates that the
system was rebooted at the indicated time. The adjacent
pair of entries with terminal names referenced by a vertical
bar (|) or a right brace (}) indicate the system-maintained
time just before and just after a date command has
changed the system's time frame.
The wtmp file is maintained by login(1) and init(8). Neither
of these programs creates the file, so, if it is
removed, record keeping is turned off. See ac(8) for
information on the file.
ac(8), init(8), last(8), lastcomm(8), login(1), who(1),
wtmpconvert(8). delim off
[ Back ]