utmp, wtmp - Login records
The utmp file records information about who is currently using the sys‐
tem. The file is a sequence of utmp entries, as defined in struct utmp
in the utmp.h file.
The utmp structure gives the name of the special file associated with
the user's terminal, the user's login name, and the time of the login
in the form of time(3). The ut_type field is the type of entry, which
can specify several symbolic constant values. The symbolic constants
are defined in the utmp.h file.
The wtmp file records all logins and logouts. A null user name indi‐
cates a logout on the associated terminal. A terminal referenced with
a tilde (~) indicates that the system was rebooted at the indicated
time. The adjacent pair of entries with terminal names referenced by a
vertical bar (|) or a right brace (}) indicate the system-maintained
time just before and just after a date command has changed the system's
The wtmp file is maintained by login(1) and init(8). Neither of these
programs creates the file, so, if it is removed, record keeping is
turned off. See ac(8) for information on the file.
FILESRELATED INFORMATIONac(8), init(8), last(8), lastcomm(8), login(1), who(1), wtmpconvert(8).