1.\" Copyright (c) 1980, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" %sccs.include.redist.roff% 5.\" 6.\" @(#)utmp.5 8.3 (Berkeley) 06/01/94 7.\" 8.Dd 9.Dt UTMP 5 10.Os BSD 4 11.Sh NAME 12.Nm utmp , 13.Nm wtmp , 14.Nm lastlog 15.Nd login records 16.Sh SYNOPSIS 17.Fd #include <utmp.h> 18.Sh DESCRIPTION 19The file 20.Aq Pa utmp.h 21declares the structures used to record information about current 22users in the file 23.Nm utmp , 24logins and logouts in the file 25.Nm wtmp , 26and last logins in the file 27.Nm lastlog . 28The time stamps of date changes, shutdowns and reboots are also logged in 29the 30.Nm wtmp 31file. 32.Pp 33These files can grow rapidly on busy systems, daily or weekly rotation 34is recommended. 35If any of these files do not exist, it is not created. 36These 37files must be created manually and are normally maintained in either the script 38.Pa /etc/daily 39or the script 40.Pa /etc/weekly . 41(See 42.Xr cron 8 . ) 43.Bd -literal -offset indent 44#define _PATH_UTMP "/var/run/utmp" 45#define _PATH_WTMP "/var/log/wtmp" 46#define _PATH_LASTLOG "/var/log/lastlog" 47 48#define UT_NAMESIZE 8 49#define UT_LINESIZE 8 50#define UT_HOSTSIZE 16 51 52struct lastlog { 53 time_t ll_time; 54 char ll_line[UT_LINESIZE]; 55 char ll_host[UT_HOSTSIZE]; 56}; 57 58struct utmp { 59 char ut_line[UT_LINESIZE]; 60 char ut_name[UT_NAMESIZE]; 61 char ut_host[UT_HOSTSIZE]; 62 long ut_time; 63}; 64.Ed 65.Pp 66Each time a user logs in, the 67.Xr login 68program looks up the user's 69.Tn UID 70in the file 71.Nm lastlog. 72If it is found, the timestamp of the last time the user logged 73in, the terminal line and the hostname 74are written to the standard output. (Providing the login is not 75.Em quiet , 76see 77.Xr login 1 . ) 78The 79.Xr login 80program then records the new login time in the file 81.Nm lastlog . 82.Pp 83After the new 84.Fa lastlog 85record is written , 86.\" the 87.\" .Xr libutil 3 88.\" routine 89the file 90.Nm utmp 91is opened and the 92.Fa utmp 93record for the user inserted. 94This record remains there until 95the user logs out at which time it is deleted. 96The 97.Nm utmp 98file is used by the programs 99.Xr rwho 1 , 100.Xr users 1 , 101.Xr w 1 , 102and 103.Xr who 1 . 104.Pp 105Next, the 106.Xr login 107program opens the file 108.Nm wtmp , 109and appends the user's 110.Fa utmp 111record. 112The same 113.Fa utmp 114record, with an updated time stamp is later appended 115to the file when the user logs out. (See 116.Xr init 8 . ) 117The 118.Nm wtmp 119file is used by the programs 120.Xr last 1 121and 122.Xr ac 8 . 123.Pp 124In the event of a date change, a shutdown or reboot, the 125following items are logged in the 126.Nm wtmp 127file. 128.ne 1i 129.Pp 130.Bl -tag -width shutdownxx -compact 131.It Li reboot 132.It Li shutdown 133A system reboot or shutdown has been initiated. 134The character 135.Ql \&~ 136is placed in the field 137.Fa ut_line , 138and 139.Li reboot 140or 141.Li shutdown 142in the field 143.Fa ut_name . 144(See 145.Xr shutdown 8 146and 147.Xr reboot 8 . ) 148.Pp 149.It Li date 150The system time has been manually or automatically updated. 151(See 152.Xr date 1 . ) 153The command name 154.Xr date 155is recorded in the field 156.Fa ut_name . 157In the field 158.Fa ut_line , 159the character 160.Ql \\*(Ba 161indicates the time prior to the change, and the character 162.Ql \&{ 163indicates the new time. 164.El 165.Sh FILES 166.Bl -tag -width /var/log/lastlog -compact 167.It Pa /var/run/utmp 168The 169.Nm utmp file. 170.It Pa /var/log/wtmp 171The 172.Nm wtmp file. 173.It Pa /var/log/lastlog 174The 175.Nm lastlog file. 176.El 177.Sh SEE ALSO 178.Xr last 1 , 179.Xr login 1 , 180.Xr who 1 , 181.Xr ac 8 , 182.Xr init 8 183.Sh HISTORY 184A 185.Nm utmp 186and 187.Nm wtmp 188file format appeared in 189.At v6 . 190The 191.Nm lastlog 192file format appeared in 193.Bx 3.0 . 194