1.\" Copyright (c) 1980, 1991 Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)utmp.5 6.8 (Berkeley) 5/5/91 33.\" 34.Dd May 5, 1991 35.Dt UTMP 5 36.Os BSD 4 37.Sh NAME 38.Nm utmp , 39.Nm wtmp , 40.Nm lastlog 41.Nd login records 42.Sh SYNOPSIS 43.Fd #include <utmp.h> 44.Sh DESCRIPTION 45The file 46.Aq Pa utmp.h 47declares the structures used to record information about current 48users in the file 49.Nm utmp , 50logins and logouts in the file 51.Nm wtmp , 52and last logins in the file 53.Nm lastlog . 54The time stamps of date changes, shutdowns and reboots are also logged in 55the 56.Nm wtmp 57file. 58.Pp 59These files can grow rapidly on busy systems, daily or weekly rotation 60is recommended. 61If any of these files do not exist, it is not created. 62These 63files must be created manually and are normally maintained in either the script 64.Pa /etc/daily 65or the script 66.Pa /etc/weekly . 67(See 68.Xr cron 8 . ) 69.Bd -literal -offset indent 70#define _PATH_UTMP "/var/run/utmp" 71#define _PATH_WTMP "/var/log/wtmp" 72#define _PATH_LASTLOG "/var/log/lastlog" 73 74#define UT_NAMESIZE 8 75#define UT_LINESIZE 8 76#define UT_HOSTSIZE 16 77 78struct lastlog { 79 time_t ll_time; 80 char ll_line[UT_LINESIZE]; 81 char ll_host[UT_HOSTSIZE]; 82}; 83 84struct utmp { 85 char ut_line[UT_LINESIZE]; 86 char ut_name[UT_NAMESIZE]; 87 char ut_host[UT_HOSTSIZE]; 88 long ut_time; 89}; 90.Ed 91.Pp 92Each time a user logs in, the 93.Xr login 94program looks up the user's 95.Tn UID 96in the file 97.Nm lastlog. 98If it is found, the timestamp of the last time the user logged 99in, the terminal line and the hostname 100are written to the standard output. (Providing the login is not 101.Em quiet , 102see 103.Xr login 1 . ) 104The 105.Xr login 106program then records the new login time in the file 107.Nm lastlog . 108.Pp 109After the new 110.Fa lastlog 111record is written , 112.\" the 113.\" .Xr libutil 3 114.\" routine 115the file 116.Nm utmp 117is opened and the 118.Fa utmp 119record for the user inserted. 120This record remains there until 121the user logs out at which time it is deleted. 122The 123.Nm utmp 124file is used by the programs 125.Xr rwho 1 , 126.Xr users 1 , 127.Xr w 1 , 128and 129.Xr who 1 . 130.Pp 131Next, the 132.Xr login 133program opens the file 134.Nm wtmp , 135and appends the user's 136.Fa utmp 137record. 138The same 139.Fa utmp 140record, with an updated time stamp is later appended 141to the file when the user logs out. (See 142.Xr init 8 . ) 143The 144.Nm wtmp 145file is used by the programs 146.Xr last 1 147and 148.Xr ac 8 . 149.Pp 150In the event of a date change, a shutdown or reboot, the 151following items are logged in the 152.Nm wtmp 153file. 154.Pp 155.Bl -tag -width shutdownxx -compact 156.It Li reboot 157.It Li shutdown 158A system reboot or shutdown has been initiated. 159The character 160.Ql \&~ 161is placed in the field 162.Fa ut_line , 163and 164.Li reboot 165or 166.Li shutdown 167in the field 168.Fa ut_name . 169(See 170.Xr shutdown 8 171and 172.Xr reboot 8 . ) 173.Pp 174.It Li date 175The system time has been manually or automatically updated. 176(See 177.Xr date 1 . ) 178The command name 179.Xr date 180is recorded in the field 181.Fa ut_name . 182In the field 183.Fa ut_line , 184the character 185.Ql \&{ 186indicates the time prior to the change, and the character 187.Ql \\*(Ba 188indicates the new time. 189.El 190.Sh FILES 191.Bl -tag -width /var/log/lastlog -compact 192.It Pa /var/run/utmp 193The 194.Nm utmp file. 195.It Pa /var/log/wtmp 196The 197.Nm wtmp file. 198.It Pa /var/log/lastlog 199The 200.Nm lastlog file. 201.El 202.Sh SEE ALSO 203.Xr last 1 , 204.Xr login 1 , 205.Xr who 1 , 206.Xr ac 8 , 207.Xr init 8 208.Sh HISTORY 209A 210.Nm utmp 211and 212.Nm wtmp 213file format appeared in 214.At v6 . 215The 216.Nm lastlog 217file format appeared in 218.Bx 3.0 . 219