UTMP(5)

NAME
utmp, wtmp - logged in users, login and logout history

SYNOPSIS
#include <sys/types.h>
#include <utmp.h>

DESCRIPTION
The files /etc/utmp and /usr/adm/wtmp respectively contain the currently logged in users, and the history of logins and logouts.

Each file is an array of the following structure defined in <utmp.h>:

struct utmp {
	char	ut_user[8];	/* user name */
	char	ut_line[12];	/* terminal name */
	char	ut_host[16];	/* host name, when remote */
	time_t	ut_time;	/* login/logout time */
};
#define ut_name ut_user	/* for compatibility with other systems */

The structure contains more fields than those listed, but they are only of interest to init and login. Note that the ut_name field is a compatibility alias for ut_user, it is actually better to use it.

A login entry is completely specified. A logout entry has a null string for ut_name. A shutdown or reboot entry has an ut_line field containing a "~" (tilde). The ut_name field is usually the name of the program that did the shutdown, or "reboot" at reboot. This is a bit confusing, but one this is clear: If you see just one such entry then the system has crashed, if you see two entries then the system was properly shut down and later rebooted.

FILES

/etc/utmp
    Currently logged in users.

/usr/adm/wtmp
    History of logins and logouts.

SEE ALSO
who(1), ttyslot(3).

AUTHOR
Kees J. Bot (kjb@cs.vu.nl)