utmpx

NAME

utmpx, wtmpx - login records

SYNOPSIS 

#include <utmpx.h>

DESCRIPTION

The file <utmpx.h> declares the structures used to record information about current users in the file utmpx, and logins and logouts in the file wtmpx, and last logins in the file lastlog. The time stamps of date changes, shutdowns, and reboots are also logged in the wtmpx file.

These files can grow rapidly on busy systems; daily or weekly rotation is recommended. If any of these files does not exist, it is not created.

#define _PATH_UTMP	"/var/adm/utmpx"
#define _PATH_WTMP	"/var/adm/wtmpx"

#define UT_NAMESIZE	 128 /* format "domain+user" */
#define UT_LINESIZE	 32  /* for tty names */
#define UT_HOSTSIZE	 128 /* for longer FQDN's */
#define UT_IDSIZE	 UT_LINESIZE
struct utmpx {
		char	ut_line[UT_LINESIZE];
		char	ut_user[UT_NAMESIZE];
		char	ut_host[UT_HOSTSIZE];
		struct timeval ut_tv;
		pid_t   ut_pid;
		uid_t   ut_uid; 		/* Real uid of user process */
		char	ut_id[UT_IDSIZE];  /* Repeats ut_line */
		short   ut_type; 	 /* Type of entry; see macros above */
		struct exit_status ut_exit;  /* DEAD_PROCESS exit information */
};

The login(1) program opens the file utmpx and inserts the utmpx record for the user. This record remains there until the user logs out, at which time it is deleted. The utmpx file is used by who(1).

Next, the login(1) program opens the file wtmpx, and appends the user's utmpx record. The same utmpx record, with an updated time stamp is later appended to the file when the user logs out. The wtmpx file is used by the program last(1).

In the event of a date change, a shutdown, or a reboot, the following items are logged in the wtmpx file:

reboot
shutdown
A system reboot or shutdown has been initiated. The character ~ is placed in the field ut_line, and or in the field ut_name.
date
The system time has been manually or automatically updated. (See date(1).) The command name date(1) is recorded in the field ut_name. In the field ut_line, the character | indicates the time prior to the change, and the character { indicates the new time.

FILES

/var/adm/utmpx
The utmpx file.
/var/adm/wtmpx
The wtmpx file.
/var/log/lastlog
The lastlog file.

SEE ALSO

last(1)

login(1)

who(1)