1UTMP(5) 386BSD Programmer's Manual UTMP(5) 2 3NNAAMMEE 4 uuttmmpp, wwttmmpp, llaassttlloogg - login records 5 6SSYYNNOOPPSSIISS 7 ##iinncclluuddee <<uuttmmpp..hh>> 8 9DDEESSCCRRIIPPTTIIOONN 10 The file <_u_t_m_p._h> declares the structures used to record information 11 about current users in the file uuttmmpp, logins and logouts in the file 12 wwttmmpp, and last logins in the file llaassttlloogg. The time stamps of date 13 changes, shutdowns and reboots are also logged in the wwttmmpp file. 14 15 These files can grow rapidly on busy systems, daily or weekly rotation is 16 recommended. If any of these files do not exist, it is not created. 17 These files must be created manually and are normally maintained in ei- 18 ther the script /_e_t_c/_d_a_i_l_y or the script /_e_t_c/_w_e_e_k_l_y. (See cron(8).) 19 20 #define _PATH_UTMP "/var/run/utmp" 21 #define _PATH_WTMP "/var/log/wtmp" 22 #define _PATH_LASTLOG "/var/log/lastlog" 23 24 #define UT_NAMESIZE 8 25 #define UT_LINESIZE 8 26 #define UT_HOSTSIZE 16 27 28 struct lastlog { 29 time_t ll_time; 30 char ll_line[UT_LINESIZE]; 31 char ll_host[UT_HOSTSIZE]; 32 }; 33 34 struct utmp { 35 char ut_line[UT_LINESIZE]; 36 char ut_name[UT_NAMESIZE]; 37 char ut_host[UT_HOSTSIZE]; 38 long ut_time; 39 }; 40 41 Each time a user logs in, the login program looks up the user's UID in 42 the file llaassttlloogg.. If it is found, the timestamp of the last time the user 43 logged in, the terminal line and the hostname are written to the standard 44 output. (Providing the login is not _q_u_i_e_t, see login(1).) The login pro- 45 gram then records the new login time in the file llaassttlloogg. 46 47 After the new _l_a_s_t_l_o_g record is written , the file uuttmmpp is opened and the 48 _u_t_m_p record for the user inserted. This record remains there until the 49 user logs out at which time it is deleted. The uuttmmpp file is used by the 50 programs rwho(1), users(1), w(1), and who(1). 51 52 Next, the login program opens the file wwttmmpp, and appends the user's _u_t_m_p 53 record. The same _u_t_m_p record, with an updated time stamp is later ap- 54 pended to the file when the user logs out. (See init(8).) The wwttmmpp file 55 is used by the programs last(1) and ac(8). 56 57 In the event of a date change, a shutdown or reboot, the following items 58 are logged in the wwttmmpp file. 59 60 reboot 61 shutdown A system reboot or shutdown has been initiated. The charac- 62 ter `~' is placed in the field _u_t__l_i_n_e, and reboot or 63 shutdown in the field _u_t__n_a_m_e. (See shutdown(8) and 64 reboot(8).) 65 66 67 date The system time has been manually or automatically updated. 68 (See date(1).) The command name date is recorded in the 69 field _u_t__n_a_m_e. In the field _u_t__l_i_n_e, the character `{' indi- 70 cates the time prior to the change, and the character `|' 71 indicates the new time. 72 73FFIILLEESS 74 /var/run/utmp The uuttmmpp ffiillee.. 75 /var/log/wtmp The wwttmmpp ffiillee.. 76 /var/log/lastlog The llaassttlloogg ffiillee.. 77 78SSEEEE AALLSSOO 79 last(1), login(1), who(1), ac(8), init(8) 80 81HHIISSTTOORRYY 82 A uuttmmpp and wwttmmpp file format appeared in Version 6 AT&T UNIX. The llaassttlloogg 83 file format appeared in 3.0BSD. 84 854th Berkeley Distribution May 5, 1991 3 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133