wtmp(4) [hpux man page]
utmp(4) Kernel Interfaces Manual utmp(4) NAME
utmp, wtmp, btmp - user login record format SYNOPSIS
DESCRIPTION
These files, which hold user and accounting information for such commands as and (see last(1), who(1), write(1), and login(1)), have the following structure as defined by #define UTMP_FILE "/etc/utmp" #define WTMP_FILE "/var/adm/wtmp" #define BTMP_FILE "/var/adm/btmp" #define ut_name ut_user struct utmp { char ut_user[8]; /* User login name */ char ut_id[4]; /* /etc/inittab id(usually line#)*/ char ut_line[12] /* device name (console, lnxx) */ pid_t ut_pid; /* process id */ short ut_type; /* type of entry */ struct exit_status short e_termination; /* Process termination status*/ short e_exit; /* Process exit status*/ } ut_exit; /* The exit status of a process*/ /* marked as DEAD_PROCESS.*/ unsigned short ut_reserved1; /* Reserved for future use*/ time_t ut_time; /* time entry was made*/ char ut_host[16]; /* host name,if remote*/ unsigned long ut_addr; /* host Internet addr, if remote*/ }; /* Definitions for ut_type */ #define EMPTY 0 #define RUN_LVL 1 #define BOOT_TIME 2 #define OLD_TIME 3 #define NEW_TIME 4 #define INIT_PROCESS 5 /* Process spawned by "init" */ #define LOGIN_PROCESS 6 /* getty process awaiting login */ #define USER_PROCESS 7 /* A user process */ #define DEAD_PROCESS 8 #define ACCOUNTING 9 #define UTMAXTYPE ACCOUNTING /* Max. legal value of ut_type */ /* Special strings or formats used in the "ut_line" field */ /* when accounting for something other than a process */ /* No string for the ut_line field can be more than */ /* 11 chars + a NULL in length */ #define RUNLVL_MSG "run-level %c" #define BOOT_MSG "system boot" #define OTIME_MSG "old time" #define NTIME_MSG "new time" File contains a record of all users logged onto the system. File contains bad login entries for each invalid logon attempt. File contains a record of all logins and logouts. Note that and tend to grow without bound, and should be checked regularly. Information that is no longer useful should be removed periodi- cally to prevent it from becoming too large. Also note that and are not created by the programs that maintain them. Thus, if these files are removed, record-keeping is turned off. FILES
AUTHOR
and were developed by HP and the University of California, Berkeley. SEE ALSO
last(1), login(1), who(1), write(1), acctcon(1M), fwtmp(1M), utmpd(1M), getut(3C), getuts(3C), getutx(3C). STANDARDS CONFORMANCE
TO BE OBSOLETED utmp(4)
Check Out this Related Man Page
UTMP(5) Linux Programmer's Manual UTMP(5) NAME
utmp, wtmp - login records SYNOPSIS
#include <utmp.h> DESCRIPTION
The utmp file allows one to discover information about who is currently using the system. There may be more users currently using the sys- tem, because not all programs use utmp logging. Warning: utmp must not be writable by the user class "other", because many system programs (foolishly) depend on its integrity. You risk faked system logfiles and modifications of system files if you leave utmp writable to any user other than the owner and group owner of the file. The file is a sequence of utmp structures, declared as follows in <utmp.h> (note that this is only one of several definitions around; details depend on the version of libc): /* Values for ut_type field, below */ #define EMPTY 0 /* Record does not contain valid info (formerly known as UT_UNKNOWN on Linux) */ #define RUN_LVL 1 /* Change in system run-level (see init(8)) */ #define BOOT_TIME 2 /* Time of system boot (in ut_tv) */ #define NEW_TIME 3 /* Time after system clock change (in ut_tv) */ #define OLD_TIME 4 /* Time before system clock change (in ut_tv) */ #define INIT_PROCESS 5 /* Process spawned by init(8) */ #define LOGIN_PROCESS 6 /* Session leader process for user login */ #define USER_PROCESS 7 /* Normal process */ #define DEAD_PROCESS 8 /* Terminated process */ #define ACCOUNTING 9 /* Not implemented */ #define UT_LINESIZE 32 #define UT_NAMESIZE 32 #define UT_HOSTSIZE 256 struct exit_status { /* Type for ut_exit, below */ short int e_termination; /* Process termination status */ short int e_exit; /* Process exit status */ }; struct utmp { short ut_type; /* Type of record */ pid_t ut_pid; /* PID of login process */ char ut_line[UT_LINESIZE]; /* Device name of tty - "/dev/" */ char ut_id[4]; /* Terminal name suffix, or inittab(5) ID */ char ut_user[UT_NAMESIZE]; /* Username */ char ut_host[UT_HOSTSIZE]; /* Hostname for remote login, or kernel version for run-level messages */ struct exit_status ut_exit; /* Exit status of a process marked as DEAD_PROCESS; not used by Linux init (1 */ /* The ut_session and ut_tv fields must be the same size when compiled 32- and 64-bit. This allows data files and shared memory to be shared between 32- and 64-bit applications. */ #if __WORDSIZE == 64 && defined __WORDSIZE_COMPAT32 int32_t ut_session; /* Session ID (getsid(2)), used for windowing */ struct { int32_t tv_sec; /* Seconds */ int32_t tv_usec; /* Microseconds */ } ut_tv; /* Time entry was made */ #else long ut_session; /* Session ID */ struct timeval ut_tv; /* Time entry was made */ #endif int32_t ut_addr_v6[4]; /* Internet address of remote host; IPv4 address uses just ut_addr_v6[0] */ char __unused[20]; /* Reserved for future use */ }; /* Backward compatibility hacks */ #define ut_name ut_user #ifndef _NO_UT_TIME #define ut_time ut_tv.tv_sec #endif #define ut_xtime ut_tv.tv_sec #define ut_addr ut_addr_v6[0] This structure gives the name of the special file associated with the user's terminal, the user's login name, and the time of login in the form of time(2). String fields are terminated by a null byte ('