usr/src/share/man/man5/utmp.5

.\" Copyright (c) 1980 Regents of the University of California.
.\" All rights reserved.  The Berkeley software License Agreement
.\" specifies the terms and conditions for redistribution.
.\"
.\"     @(#)utmp.5      6.4 (Berkeley) %G%
.\"
.TH UTMP 5  ""
.UC 4
.SH NAME
utmp, wtmp \- login records
.SH SYNOPSIS
.B #include <utmp.h>
.SH DESCRIPTION
The
.I utmp
file records information about who is currently using the system.
The file is a sequence of entries with the following structure, as
defined in the include file.
.RS
.PP
.nf
struct utmp {
        char    ut_line[8];
        char    ut_name[8];
        char    ut_host[16];
        time_t  ut_time;
};
.ft R
.ad
.fi
.RE
.PP
This structure gives the name of the special file
associated with the user's terminal, the user's login name,
and the time of the login in the form of
.IR time (3).
.PP
The
.I wtmp
file records all logins and logouts.
A null user name indicates a logout on the associated terminal.
Furthermore, the terminal name `~' indicates that the system was
rebooted at the indicated time; in such cases the name will be
``shutdown''.  An adjacent pair of entries with terminal names
`\^|\^' and `{' indicate the system-maintained time just before
and just after a
.I date
command has changed the system's idea of the time.  The name for
both entries will be ``date''.
.PP
.I Wtmp
is maintained by
.IR login (1)
and
.IR init (8).
Neither of these programs creates the file, so if it is removed
record-keeping is turned off.  It is summarized by
.IR last (1)
and
.IR ac (8).
.SH FILES
/etc/utmp
.br
/usr/adm/wtmp
.SH "SEE ALSO"
last(1), login(1), who(1), ac(8), init(8)