Utmp
Encyclopedia
utmp, wtmp, btmp and variants such as utmpx, wtmpx and btmpx are files on Unix-like
systems that keeps track of all logins
and logouts to the system.
The utmp file keeps track of the current login state of each user. The wtmp file records all logins and logouts history. The btmp file records failed login attempts.
The utmp, wtmp and btmp files were never a part of any official Unix standard, such as Single UNIX Specification
, while utmpx and corresponding APIs are part of it.
The wtmp and btmp format are exactly like utmp except that a null user name indicates a logout on the associated terminal. Furthermore, the terminal name ~ with user name shutdown or reboot indicates a system shutdown or reboot and the pair of terminal names / logs the old/new system time when date changes it.
. Utmpx is specified in POSIX
.
While some systems create different files for the utmpx variants and have obsoleted former formats, this is not always the case. Linux
for example just defines the utmpx structure to be the same as utmp.
The utmpx database contains user access and accounting information, while wtmpx database contains the history of user access and accounting information.
Linux :
/var/run/utmp
/var/log/wtmp
/var/log/btmp
Solaris:
/var/adm/utmp (deprecated), /var/adm/utmpx
/var/adm/wtmp (deprecated), /var/adm/wtmpx
HP-UX:
/etc/utmp (deprecated), /etc/utmpx
/var/adm/wtmp (deprecated), /var/adm/wtmpx
/var/adm/btmp (deprecated), /var/adm/btmpx
FreeBSD 9.0 introduced new files while adding support for utmpx:
/var/run/utx.active (replaces utmp)
/var/log/utx.lastlogin (replaces lastlog)
/var/log/utx.log (replaces wtmp)
(which show current system users), last (which show last logged in users) and lastb (which show last failed login attempts).
Unix-like
A Unix-like operating system is one that behaves in a manner similar to a Unix system, while not necessarily conforming to or being certified to any version of the Single UNIX Specification....
systems that keeps track of all logins
Logging (computer security)
In computer security, a login or logon is the process by which individual access to a computer system is controlled by identifying and authentifying the user referring to credentials presented by the user.A user can log in to a system to obtain access and can then log out or log off In computer...
and logouts to the system.
The utmp file keeps track of the current login state of each user. The wtmp file records all logins and logouts history. The btmp file records failed login attempts.
The utmp, wtmp and btmp files were never a part of any official Unix standard, such as Single UNIX Specification
Single UNIX Specification
The Single UNIX Specification is the collective name of a family of standards for computer operating systems to qualify for the name "Unix"...
, while utmpx and corresponding APIs are part of it.
utmp, wtmp and btmp
The utmp file is not a text file, but rather a binary format which needs to be edited by specially crafted programs. The implementation and the fields present in the file differ depending of the system or the libc version, and are defined in the utmp.h header file.The wtmp and btmp format are exactly like utmp except that a null user name indicates a logout on the associated terminal. Furthermore, the terminal name ~ with user name shutdown or reboot indicates a system shutdown or reboot and the pair of terminal names / logs the old/new system time when date changes it.
utmpx, wtmpx and btmpx
Utmpx and wtmpx are extensions to the original utmp and wtmp, originating from Sun MicrosystemsSun Microsystems
Sun Microsystems, Inc. was a company that sold :computers, computer components, :computer software, and :information technology services. Sun was founded on February 24, 1982...
. Utmpx is specified in POSIX
POSIX
POSIX , an acronym for "Portable Operating System Interface", is a family of standards specified by the IEEE for maintaining compatibility between operating systems...
.
While some systems create different files for the utmpx variants and have obsoleted former formats, this is not always the case. Linux
Linux
Linux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
for example just defines the utmpx structure to be the same as utmp.
The utmpx database contains user access and accounting information, while wtmpx database contains the history of user access and accounting information.
Location
Depending of the system, those files may commonly be found in different places (non-exhaustive list) :Linux :
/var/run/utmp
/var/log/wtmp
/var/log/btmp
Solaris:
/var/adm/utmp (deprecated), /var/adm/utmpx
/var/adm/wtmp (deprecated), /var/adm/wtmpx
HP-UX:
/etc/utmp (deprecated), /etc/utmpx
/var/adm/wtmp (deprecated), /var/adm/wtmpx
/var/adm/btmp (deprecated), /var/adm/btmpx
FreeBSD 9.0 introduced new files while adding support for utmpx:
/var/run/utx.active (replaces utmp)
/var/log/utx.lastlogin (replaces lastlog)
/var/log/utx.log (replaces wtmp)
Related commands
Different commands allow to consult the information stored in those files, including whoWho (Unix)
The standard Unix command who displays a list of users who are currently logged into a computer.The who command is related to the command w, which provides the same information but also displays additional data and statistics.- Specification :...
(which show current system users), last (which show last logged in users) and lastb (which show last failed login attempts).