1.\" Copyright (c) 1980, 1991 Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" from: @(#)utmp.5 6.8 (Berkeley) 5/5/91 33.\" $Id: utmp.5,v 1.3 1994/03/09 22:49:38 cgd Exp $ 34.\" 35.Dd May 5, 1991 36.Dt UTMP 5 37.Os BSD 4 38.Sh NAME 39.Nm utmp , 40.Nm wtmp , 41.Nm lastlog 42.Nd login records 43.Sh SYNOPSIS 44.Fd #include <utmp.h> 45.Sh DESCRIPTION 46The file 47.Aq Pa utmp.h 48declares the structures used to record information about current 49users in the file 50.Nm utmp , 51logins and logouts in the file 52.Nm wtmp , 53and last logins in the file 54.Nm lastlog . 55The time stamps of date changes, shutdowns and reboots are also logged in 56the 57.Nm wtmp 58file. 59.Pp 60These files can grow rapidly on busy systems, daily or weekly rotation 61is recommended. 62If any of these files do not exist, it is not created. 63These 64files must be created manually and are normally maintained in either the script 65.Pa /etc/daily 66or the script 67.Pa /etc/weekly . 68(See 69.Xr cron 8 . ) 70.Bd -literal -offset indent 71#define _PATH_UTMP "/var/run/utmp" 72#define _PATH_WTMP "/var/log/wtmp" 73#define _PATH_LASTLOG "/var/log/lastlog" 74 75#define UT_NAMESIZE 8 76#define UT_LINESIZE 8 77#define UT_HOSTSIZE 16 78 79struct lastlog { 80 time_t ll_time; 81 char ll_line[UT_LINESIZE]; 82 char ll_host[UT_HOSTSIZE]; 83}; 84 85struct utmp { 86 char ut_line[UT_LINESIZE]; 87 char ut_name[UT_NAMESIZE]; 88 char ut_host[UT_HOSTSIZE]; 89 long ut_time; 90}; 91.Ed 92.Pp 93Each time a user logs in, the 94.Xr login 95program looks up the user's 96.Tn UID 97in the file 98.Nm lastlog. 99If it is found, the timestamp of the last time the user logged 100in, the terminal line and the hostname 101are written to the standard output. (Providing the login is not 102.Em quiet , 103see 104.Xr login 1 . ) 105The 106.Xr login 107program then records the new login time in the file 108.Nm lastlog . 109.Pp 110After the new 111.Fa lastlog 112record is written , 113.\" the 114.\" .Xr libutil 3 115.\" routine 116the file 117.Nm utmp 118is opened and the 119.Fa utmp 120record for the user inserted. 121This record remains there until 122the user logs out at which time it is deleted. 123The 124.Nm utmp 125file is used by the programs 126.Xr rwho 1 , 127.Xr users 1 , 128.Xr w 1 , 129and 130.Xr who 1 . 131.Pp 132Next, the 133.Xr login 134program opens the file 135.Nm wtmp , 136and appends the user's 137.Fa utmp 138record. 139The same 140.Fa utmp 141record, with an updated time stamp is later appended 142to the file when the user logs out. (See 143.Xr init 8 . ) 144The 145.Nm wtmp 146file is used by the programs 147.Xr last 1 148and 149.Xr ac 8 . 150.Pp 151In the event of a date change, a shutdown or reboot, the 152following items are logged in the 153.Nm wtmp 154file. 155.Pp 156.Bl -tag -width shutdownxx -compact 157.It Li reboot 158.It Li shutdown 159A system reboot or shutdown has been initiated. 160The character 161.Ql \&~ 162is placed in the field 163.Fa ut_line , 164and 165.Li reboot 166or 167.Li shutdown 168in the field 169.Fa ut_name . 170(See 171.Xr shutdown 8 172and 173.Xr reboot 8 . ) 174.Pp 175.It Li date 176The system time has been manually or automatically updated. 177(See 178.Xr date 1 . ) 179The command name 180.Xr date 181is recorded in the field 182.Fa ut_name . 183In the field 184.Fa ut_line , 185the character 186.Ql \\*(Ba 187indicates the time prior to the change, and the character 188.Ql \&{ 189indicates the new time. 190.El 191.Sh FILES 192.Bl -tag -width /var/log/lastlog -compact 193.It Pa /var/run/utmp 194The 195.Nm utmp file. 196.It Pa /var/log/wtmp 197The 198.Nm wtmp file. 199.It Pa /var/log/lastlog 200The 201.Nm lastlog file. 202.El 203.Sh SEE ALSO 204.Xr last 1 , 205.Xr login 1 , 206.Xr who 1 , 207.Xr ac 8 , 208.Xr init 8 209.Sh HISTORY 210A 211.Nm utmp 212and 213.Nm wtmp 214file format appeared in 215.At v6 . 216The 217.Nm lastlog 218file format appeared in 219.Bx 3.0 . 220