xref: /csrg-svn/share/man/man5/utmp.5 (revision 66368)
161611Sbostic.\" Copyright (c) 1980, 1991, 1993
261611Sbostic.\"	The Regents of the University of California.  All rights reserved.
320770Smckusick.\"
449204Scael.\" %sccs.include.redist.roff%
520770Smckusick.\"
6*66368Sbostic.\"     @(#)utmp.5	8.2 (Berkeley) 03/17/94
748833Scael.\"
849204Scael.Dd
949204Scael.Dt UTMP 5
1049204Scael.Os BSD 4
1149204Scael.Sh NAME
1249204Scael.Nm utmp ,
1349204Scael.Nm wtmp ,
1449204Scael.Nm lastlog
1549204Scael.Nd login records
1649204Scael.Sh SYNOPSIS
1749204Scael.Fd #include <utmp.h>
1849204Scael.Sh DESCRIPTION
1949204ScaelThe file
2049204Scael.Aq Pa utmp.h
2149204Scaeldeclares the structures used to record information about current
2249204Scaelusers in the file
2349204Scael.Nm utmp ,
2449204Scaellogins and logouts in the file
2549204Scael.Nm wtmp ,
2649204Scaeland last logins in the file
2749204Scael.Nm lastlog .
2849204ScaelThe time stamps of date changes, shutdowns and reboots are also logged in
2949204Scaelthe
3049204Scael.Nm wtmp
3149204Scaelfile.
3249204Scael.Pp
3349204ScaelThese files can grow rapidly on busy systems, daily or weekly rotation
3449204Scaelis recommended.
3549204ScaelIf any of these files do not exist, it is not created.
3649204ScaelThese
3749204Scaelfiles must be created manually and are normally maintained in either the script
3849204Scael.Pa /etc/daily
3949204Scaelor the script
4049204Scael.Pa /etc/weekly .
4149204Scael(See
4249204Scael.Xr cron 8 . )
4349204Scael.Bd -literal -offset indent
4449204Scael#define _PATH_UTMP      "/var/run/utmp"
4549204Scael#define _PATH_WTMP      "/var/log/wtmp"
4649204Scael#define _PATH_LASTLOG   "/var/log/lastlog"
4749204Scael
4849204Scael#define UT_NAMESIZE     8
4949204Scael#define UT_LINESIZE     8
5049204Scael#define UT_HOSTSIZE     16
5149204Scael
5249204Scaelstruct lastlog {
5349204Scael        time_t  ll_time;
5449204Scael        char    ll_line[UT_LINESIZE];
5549204Scael        char    ll_host[UT_HOSTSIZE];
5649204Scael};
5749204Scael
5835603Sbosticstruct utmp {
5949204Scael        char    ut_line[UT_LINESIZE];
6049204Scael        char    ut_name[UT_NAMESIZE];
6149204Scael        char    ut_host[UT_HOSTSIZE];
6249204Scael        long    ut_time;
6335603Sbostic};
6449204Scael.Ed
6549204Scael.Pp
6649204ScaelEach time a user logs in, the
6749204Scael.Xr login
6849204Scaelprogram looks up the user's
6949204Scael.Tn UID
7049204Scaelin the file
7149204Scael.Nm lastlog.
7249204ScaelIf it is found, the timestamp of the last time the user logged
7349204Scaelin, the terminal line and the hostname
7449204Scaelare written to the standard output. (Providing the login is not
7549204Scael.Em quiet ,
7649204Scaelsee
7749204Scael.Xr login 1 . )
7820770SmckusickThe
7949204Scael.Xr login
8049204Scaelprogram then records the new login time in the file
8149204Scael.Nm lastlog .
8249204Scael.Pp
8349204ScaelAfter the new
8449204Scael.Fa lastlog
8549204Scaelrecord is written ,
8649204Scael.\" the
8749204Scael.\" .Xr libutil 3
8849204Scael.\" routine
8949204Scaelthe file
9049204Scael.Nm utmp
9149204Scaelis opened and the
9249204Scael.Fa utmp
9349204Scaelrecord for the user inserted.
9449204ScaelThis record remains there until
9549204Scaelthe user logs out at which time it is deleted.
9649204ScaelThe
9749204Scael.Nm utmp
9849204Scaelfile is used by the programs
9949204Scael.Xr rwho 1 ,
10049204Scael.Xr users 1 ,
10149204Scael.Xr w 1 ,
10220770Smckusickand
10349204Scael.Xr who 1 .
10449204Scael.Pp
10549204ScaelNext, the
10649204Scael.Xr login
10749204Scaelprogram opens the file
10849204Scael.Nm wtmp ,
10949204Scaeland appends the user's
11049204Scael.Fa utmp
11149204Scaelrecord.
11249204ScaelThe same
11349204Scael.Fa utmp
11449204Scaelrecord, with an updated time stamp is later appended
11549204Scaelto the file when the user logs out. (See
11649204Scael.Xr init 8 . )
11749204ScaelThe
11849204Scael.Nm wtmp
11949204Scaelfile is used by the programs
12049204Scael.Xr last 1
12135603Sbosticand
12249204Scael.Xr ac 8 .
12349204Scael.Pp
12449204ScaelIn the event of a date change, a shutdown or reboot, the
12549204Scaelfollowing items are logged in the
12649204Scael.Nm wtmp
12749204Scaelfile.
12849204Scael.Pp
12949204Scael.Bl -tag -width shutdownxx -compact
13049204Scael.It Li reboot
13149204Scael.It Li shutdown
13249204ScaelA system reboot or shutdown has been initiated.
13349204ScaelThe character
13449204Scael.Ql \&~
13549204Scaelis placed in the field
13649204Scael.Fa ut_line ,
13749204Scaeland
13849204Scael.Li reboot
13949204Scaelor
14049204Scael.Li shutdown
14149204Scaelin the field
14249204Scael.Fa ut_name .
14349204Scael(See
14449204Scael.Xr shutdown 8
14549204Scaeland
14649204Scael.Xr reboot 8 . )
14749204Scael.Pp
14849204Scael.It Li date
14949204ScaelThe system time has been manually or automatically updated.
15049204Scael(See
15149204Scael.Xr date 1 . )
15249204ScaelThe command name
15349204Scael.Xr date
15449204Scaelis recorded in the field
15549204Scael.Fa ut_name .
15649204ScaelIn the field
15749204Scael.Fa ut_line ,
15849204Scaelthe character
159*66368Sbostic.Ql \\*(Ba
160*66368Sbosticindicates the time prior to the change, and the character
16149204Scael.Ql \&{
16249204Scaelindicates the new time.
16349204Scael.El
16449204Scael.Sh FILES
16549204Scael.Bl -tag -width /var/log/lastlog -compact
16649204Scael.It Pa /var/run/utmp
16749204ScaelThe
16849204Scael.Nm utmp file.
16949204Scael.It Pa /var/log/wtmp
17049204ScaelThe
17149204Scael.Nm wtmp file.
17249204Scael.It Pa /var/log/lastlog
17349204ScaelThe
17449204Scael.Nm lastlog file.
17549204Scael.El
17649204Scael.Sh SEE ALSO
17749204Scael.Xr last 1 ,
17849204Scael.Xr login 1 ,
17949204Scael.Xr who 1 ,
18049204Scael.Xr ac 8 ,
18149204Scael.Xr init 8
18249204Scael.Sh HISTORY
18349204ScaelA
18449204Scael.Nm utmp
18549204Scaeland
18649204Scael.Nm wtmp
18749204Scaelfile format appeared in
18849204Scael.At v6 .
18949204ScaelThe
19049204Scael.Nm lastlog
19149204Scaelfile format appeared in
19249204Scael.Bx 3.0 .
193