utmp, wtmp, btmp and variants such as utmpx, wtmpx and btmpx are files on

Unix-like A Unix-like (sometimes referred to as UN*X, *nix or *NIX) operating system is one that behaves in a manner similar to a Unix system, although not necessarily conforming to or being certified to any version of the Single UNIX Specification. A Uni ...

systems that keep track of all logins and

logout In computer security, logging in (or logging on, signing in, or signing on) is the process by which an individual gains access to a computer system or program by identifying and authenticating themselves. Typically, user credentials c ...

s to the system.

Format

utmp, wtmp and btmp

* utmp maintains a full accounting of the ''current'' status of the system, system boot time (used by ''uptime''), recording user logins at which terminals, logouts, system events etc. * wtmp acts as a historical utmp * btmp records failed login attempts These files are not regular text files, but rather a binary format which needs to be edited by specially crafted programs. The implementation and the fields present in the file differ depending on the system or the libc version, and are defined in the utmp.h header file. The wtmp and btmp format are exactly like utmp except that a null value for "username" indicates a logout on the associated terminal (the actual user name is located by finding the preceding login on that terminal). Furthermore, the value "~" as a terminal name with username "shutdown" or "reboot" indicates a system shutdown or reboot (respectively). These files are not set by any given PAM module (such as pam_unix.so or pam_sss.so) but are set by the application performing the operation (e.g. min getty, /bin/login, or sshd). As such it is the obligation of the program itself to record the utmp information.

utmpx, wtmpx and btmpx

Utmpx and wtmpx are extensions to the original utmp and wtmp, originating from

Sun Microsystems Sun Microsystems, Inc., often known as Sun for short, was an American technology company that existed from 1982 to 2010 which developed and sold computers, computer components, software, and information technology services. Sun contributed sig ...

. Utmpx is specified in

POSIX The Portable Operating System Interface (POSIX; ) is a family of standards specified by the IEEE Computer Society for maintaining compatibility between operating systems. POSIX defines application programming interfaces (APIs), along with comm ...

. The utmp, wtmp and btmp files were never a part of any official Unix standard, such as

Single UNIX Specification The Single UNIX Specification (SUS) is a standard for computer operating systems, compliance with which is required to qualify for using the "UNIX" trademark. The standard specifies programming interfaces for the C language, a command-line shell, ...

, while utmpx and corresponding APIs are part of it. While some systems create different newer files for the utmpx variants and have deprecated/obsoleted former formats, this is not always the case.

Linux Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...

for example uses the utmpx structure in the place of the older file structure.

Location

Depending on the system, those files may commonly be found in different places (non-exhaustive list) :

AIX Aix or AIX may refer to: Computing * AIX, a line of IBM computer operating systems *Alternate index, for an IBM Virtual Storage Access Method key-sequenced data set * Athens Internet Exchange, a European Internet exchange point Places Belg ...

: /etc/utmp /var/adm/wtmp

: /var/run/utmp /var/log/wtmp /var/log/btmp

Solaris Solaris is the Latin word for sun. It may refer to: Arts and entertainment Literature, television and film * ''Solaris'' (novel), a 1961 science fiction novel by Stanisław Lem ** ''Solaris'' (1968 film), directed by Boris Nirenburg ** ''Sol ...

: /var/adm/utmp (deprecated), /var/adm/utmpx /var/adm/wtmp (deprecated), /var/adm/wtmpx

HP-UX HP-UX (from "Hewlett Packard Unix") is a proprietary software, proprietary implementation of the Unix operating system developed by Hewlett Packard Enterprise; current versions support HPE Integrity Servers, based on Intel's Itanium architect ...

: /etc/utmp (deprecated), /etc/utmpx /var/adm/wtmp (deprecated), /var/adm/wtmpx /var/adm/btmp (deprecated), /var/adm/btmpx FreeBSD 9.0 introduced new files while adding support for utmpx: /var/run/utx.active (replaces utmp) /var/log/utx.lastlogin (replaces lastlog) /var/log/utx.log (replaces wtmp)

Related commands

Different commands allow users to consult the information stored in those files. This includes programs ''

who The World Health Organization (WHO) is a specialized agency of the United Nations which coordinates responses to international public health issues and emergencies. It is headquartered in Geneva, Switzerland, and has 6 regional offices and 15 ...

'' (which show current system users), ''last'' (which shows the last logged in users) and ''lastb'' (which shows the last failed login attempts; Linux-specific).

References

External links

* * * * * * Unix Unix software {{Unix-stub