1.\" Copyright (c) 1980, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" %sccs.include.redist.roff% 5.\" 6.\" @(#)utmp.5 8.2 (Berkeley) 03/17/94 7.\" 8.Dd 9.Dt UTMP 5 10.Os BSD 4 11.Sh NAME 12.Nm utmp , 13.Nm wtmp , 14.Nm lastlog 15.Nd login records 16.Sh SYNOPSIS 17.Fd #include <utmp.h> 18.Sh DESCRIPTION 19The file 20.Aq Pa utmp.h 21declares the structures used to record information about current 22users in the file 23.Nm utmp , 24logins and logouts in the file 25.Nm wtmp , 26and last logins in the file 27.Nm lastlog . 28The time stamps of date changes, shutdowns and reboots are also logged in 29the 30.Nm wtmp 31file. 32.Pp 33These files can grow rapidly on busy systems, daily or weekly rotation 34is recommended. 35If any of these files do not exist, it is not created. 36These 37files must be created manually and are normally maintained in either the script 38.Pa /etc/daily 39or the script 40.Pa /etc/weekly . 41(See 42.Xr cron 8 . ) 43.Bd -literal -offset indent 44#define _PATH_UTMP "/var/run/utmp" 45#define _PATH_WTMP "/var/log/wtmp" 46#define _PATH_LASTLOG "/var/log/lastlog" 47 48#define UT_NAMESIZE 8 49#define UT_LINESIZE 8 50#define UT_HOSTSIZE 16 51 52struct lastlog { 53 time_t ll_time; 54 char ll_line[UT_LINESIZE]; 55 char ll_host[UT_HOSTSIZE]; 56}; 57 58struct utmp { 59 char ut_line[UT_LINESIZE]; 60 char ut_name[UT_NAMESIZE]; 61 char ut_host[UT_HOSTSIZE]; 62 long ut_time; 63}; 64.Ed 65.Pp 66Each time a user logs in, the 67.Xr login 68program looks up the user's 69.Tn UID 70in the file 71.Nm lastlog. 72If it is found, the timestamp of the last time the user logged 73in, the terminal line and the hostname 74are written to the standard output. (Providing the login is not 75.Em quiet , 76see 77.Xr login 1 . ) 78The 79.Xr login 80program then records the new login time in the file 81.Nm lastlog . 82.Pp 83After the new 84.Fa lastlog 85record is written , 86.\" the 87.\" .Xr libutil 3 88.\" routine 89the file 90.Nm utmp 91is opened and the 92.Fa utmp 93record for the user inserted. 94This record remains there until 95the user logs out at which time it is deleted. 96The 97.Nm utmp 98file is used by the programs 99.Xr rwho 1 , 100.Xr users 1 , 101.Xr w 1 , 102and 103.Xr who 1 . 104.Pp 105Next, the 106.Xr login 107program opens the file 108.Nm wtmp , 109and appends the user's 110.Fa utmp 111record. 112The same 113.Fa utmp 114record, with an updated time stamp is later appended 115to the file when the user logs out. (See 116.Xr init 8 . ) 117The 118.Nm wtmp 119file is used by the programs 120.Xr last 1 121and 122.Xr ac 8 . 123.Pp 124In the event of a date change, a shutdown or reboot, the 125following items are logged in the 126.Nm wtmp 127file. 128.Pp 129.Bl -tag -width shutdownxx -compact 130.It Li reboot 131.It Li shutdown 132A system reboot or shutdown has been initiated. 133The character 134.Ql \&~ 135is placed in the field 136.Fa ut_line , 137and 138.Li reboot 139or 140.Li shutdown 141in the field 142.Fa ut_name . 143(See 144.Xr shutdown 8 145and 146.Xr reboot 8 . ) 147.Pp 148.It Li date 149The system time has been manually or automatically updated. 150(See 151.Xr date 1 . ) 152The command name 153.Xr date 154is recorded in the field 155.Fa ut_name . 156In the field 157.Fa ut_line , 158the character 159.Ql \\*(Ba 160indicates the time prior to the change, and the character 161.Ql \&{ 162indicates the new time. 163.El 164.Sh FILES 165.Bl -tag -width /var/log/lastlog -compact 166.It Pa /var/run/utmp 167The 168.Nm utmp file. 169.It Pa /var/log/wtmp 170The 171.Nm wtmp file. 172.It Pa /var/log/lastlog 173The 174.Nm lastlog file. 175.El 176.Sh SEE ALSO 177.Xr last 1 , 178.Xr login 1 , 179.Xr who 1 , 180.Xr ac 8 , 181.Xr init 8 182.Sh HISTORY 183A 184.Nm utmp 185and 186.Nm wtmp 187file format appeared in 188.At v6 . 189The 190.Nm lastlog 191file format appeared in 192.Bx 3.0 . 193