utmp

utmp, wtmp, btmp and variants such as utmpx, wtmpx and btmpx are files on Unix-like systems that keep track of all logins and logouts to the system.^[1]

Format

utmp, wtmp and btmp

utmp maintains a full accounting of the current status of the system, system boot time (used by uptime), recording user logins at which terminals, logouts, system events etc.
wtmp acts as a historical utmp
btmp records failed login attempts

These files are not regular text files, but rather a binary format which needs to be edited by specially crafted programs. The implementation and the fields present in the file differ depending on the system or the libc version, and are defined in the utmp.h header file. The wtmp and btmp format are exactly like utmp except that a null value for "username" indicates a logout on the associated terminal (the actual user name is located by finding the preceding login on that terminal). Furthermore, the value "~" as a terminal name with username "shutdown" or "reboot" indicates a system shutdown or reboot (respectively).^[2]

These files are not set by any given PAM module (such as pam_unix.so or pam_sss.so) but are set by the application performing the operation (e.g. mingetty, /bin/login, or sshd). As such it is the obligation of the program itself to record the utmp information.

utmpx, wtmpx and btmpx

Utmpx and wtmpx are extensions to the original utmp and wtmp, originating from Sun Microsystems. Utmpx is specified in POSIX.^[3] The utmp, wtmp and btmp files were never a part of any official Unix standard, such as Single UNIX Specification, while utmpx and corresponding APIs are part of it.^[4]^[5] While some systems create different newer files for the utmpx variants and have deprecated/obsoleted former formats, this is not always the case. Linux for example uses the utmpx structure in the place of the older file structure.

Location

Depending on the system, those files may commonly be found in different places (non-exhaustive list) :

AIX:^[6]

/etc/utmp
/var/adm/wtmp

Linux:

/var/run/utmp
/var/log/wtmp
/var/log/btmp

Solaris:^[7]

/var/adm/utmp (deprecated), /var/adm/utmpx
/var/adm/wtmp (deprecated), /var/adm/wtmpx

HP-UX:

/etc/utmp (deprecated), /etc/utmpx
/var/adm/wtmp (deprecated), /var/adm/wtmpx
/var/adm/btmp (deprecated), /var/adm/btmpx

FreeBSD 9.0 introduced new files while adding support for utmpx:^[8]

/var/run/utx.active (replaces utmp)
/var/log/utx.lastlogin (replaces lastlog)
/var/log/utx.log (replaces wtmp)

Related commands

Different commands allow users to consult the information stored in those files. This includes programs who (which show current system users), last (which shows the last logged in users) and lastb (which shows the last failed login attempts; Linux-specific).

References

^ "man utmp (5)". manpages.org.
^ "util-linux". github.com. v2.37.2. login-utils/last.c. 2020-12-01. lines 740-750.
^ "utmpx.h - Man Page". www.mankier.com. Institute of Electrical and Electronics Engineers, Inc and The Open Group. Archived from the original on 2023-03-09.
^ "utmpx.h - user accounting database definitions". The Open Group Base Specifications. The IEEE and The Open Group. Archived from the original on 8 Sep 2012.
^ "Ed's short guide on utmp(x)". 80386.nl. January 12, 2012. Archived from the original on 1 Jul 2012.
^ "utmp, wtmp, failedlogin File Format". IBM. March 24, 2023.
^ andy (May 25, 2010). "Solaris Trim wtmpx file". UNIX Note. Archived from the original on 2014-07-07.
^ Ed Schouten (2010-01-13). "utmpx.h". github.com. 9.0.0. include/utmpx.h. lines 41-66.

External links

last(1): indicate last logins of users and ttys – FreeBSD General Commands Manual
getutxent(3): user login and logouts, and some system activities – FreeBSD Library Functions Manual
last(1): show listing of last logged in users – Linux User Commands Manual
utmp(5): login records – Linux Programmer's Manual – File Formats
last(1): display login and logout information about users and terminals – Solaris 11.4 User Commands Reference Manual
wtmp(5): utmp and wtmp entry formats – Solaris 11.4 File Formats Reference Manual

This Unix-related article is a stub. You can help Wikipedia by expanding it.

[1] "man utmp (5)". manpages.org.

[2] "util-linux". github.com. v2.37.2. login-utils/last.c. 2020-12-01. lines 740-750.

[3] "utmpx.h - Man Page". www.mankier.com. Institute of Electrical and Electronics Engineers, Inc and The Open Group. Archived from the original on 2023-03-09.

[4] "utmpx.h - user accounting database definitions". The Open Group Base Specifications. The IEEE and The Open Group. Archived from the original on 8 Sep 2012.

[5] "Ed's short guide on utmp(x)". 80386.nl. January 12, 2012. Archived from the original on 1 Jul 2012.

[6] "utmp, wtmp, failedlogin File Format". IBM. March 24, 2023.

[7] y (May 25, 2010). "Solaris Trim wtmpx file". UNIX Note. Archived from the original on 2014-07-07.

[8] Ed Schouten (2010-01-13). "utmpx.h". github.com. 9.0.0. include/utmpx.h. lines 41-66.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]