utmp, wtmp - Login records
The utmp file records information about who is currently using the system.
The file is a sequence of utmp entries, as defined in struct utmp in the
The utmp structure gives the name of the special file associated with the
user's terminal, the user's login name, and the time of the login in the
form of time(3). The ut_type field is the type of entry, which can specify
several symbolic constant values. The symbolic constants are defined in the
The wtmp file records all logins and logouts. A null user name indicates a
logout on the associated terminal. A terminal referenced with a tilde (~)
indicates that the system was rebooted at the indicated time. The adjacent
pair of entries with terminal names referenced by a vertical bar (|) or a
right brace (}) indicate the system-maintained time just before and just
after a date command has changed the system's time frame.
The wtmp file is maintained by login(1) and init(8). Neither of these pro-
grams creates the file, so, if it is removed, record keeping is turned off.
See ac(8) for information on the file.
ac(8), init(8), last(8), lastcomm(8), login(1), who(1), wtmpconvert(8).