UTMP(5)UTMP(5)NAME
utmp, wtmp - logged in users, login and logout history
SYNOPSIS
#include <sys/types.h>
#include <utmp.h>
DESCRIPTION
The files /etc/utmp and /usr/adm/wtmp respectively contain the cur‐
rently logged in users, and the history of logins and logouts.
Each file is an array of the following structure defined in <utmp.h>:
struct utmp {
char ut_user[8]; /* user name */
char ut_line[12]; /* terminal name */
char ut_host[16]; /* host name, when remote */
time_t ut_time; /* login/logout time */
};
#define ut_name ut_user/* for compatibility with other systems */
The structure contains more fields than those listed, but they are only
of interest to init and login. Note that the ut_name field is a com‐
patibility alias for ut_user, it is actually better to use it.
A login entry is completely specified. A logout entry has a null
string for ut_name. A shutdown or reboot entry has an ut_line field
containing a "~" (tilde). The ut_name field is usually the name of the
program that did the shutdown, or "reboot" at reboot. This is a bit
confusing, but note that there should always be two such entries. If
you see just one entry then the system has crashed, if you see two
entries then the system was properly shut down and later rebooted.
FILES
/etc/utmp Currently logged in users.
/usr/adm/wtmp History of logins and logouts.
SEE ALSOwho(1), ttyslot(3).
AUTHOR
Kees J. Bot (kjb@cs.vu.nl)
UTMP(5)
