UTMP(5) File Formats Manual UTMP(5)
NAME
utmp, wtmp - logged in users, login and logout history
SYNOPSIS
#include <sys/types.h>
#include <utmp.h>
DESCRIPTION
The files /etc/utmp and /usr/adm/wtmp respectively contain the cur-
rently logged in users, and the history of logins and logouts.
Each file is an array of the following structure defined in <utmp.h>:
struct utmp {
char ut_user[8]; /* user name */
char ut_line[12]; /* terminal name */
char ut_host[16]; /* host name, when remote */
time_t ut_time; /* login/logout time */
};
#define ut_name ut_user/* for compatibility with other systems */
The structure contains more fields than those listed, but they are only
of interest to init and login. Note that the ut_name field is a com-
patibility alias for ut_user, it is actually better to use it.
A login entry is completely specified. A logout entry has a null
string for ut_name. A shutdown or reboot entry has an ut_line field
containing a "~" (tilde). The ut_name field is usually the name of the
program that did the shutdown, or "reboot" at reboot. This is a bit
confusing, but note that there should always be two such entries. If
you see just one entry then the system has crashed, if you see two en-
tries then the system was properly shut down and later rebooted.
FILES
/etc/utmp Currently logged in users.
/usr/adm/wtmp History of logins and logouts.
SEE ALSO
who(1), ttyslot(3).
AUTHOR
Kees J. Bot (
[email protected])
UTMP(5)