utmp(5)                                                         utmp(5)

  utmpx

  NAME

    utmpx, wtmpx - login records

  SYNOPSIS

    #include 

  DESCRIPTION

    The file  declares the structures used to record information
    about current users in the file utmpx, and logins and logouts in the file
    wtmpx, and last logins in the file lastlog. The time stamps of date
    changes, shutdowns, and reboots are also logged in the wtmpx file.

    These files can grow rapidly on busy systems; daily or weekly rotation is
    recommended. If any of these files does not exist, it is not created.

    #define _PATH_UTMP      "/var/adm/utmpx"
    #define _PATH_WTMP      "/var/adm/wtmpx"

    #define UT_NAMESIZE     128 /* format "domain+user" */
    #define UT_LINESIZE     32  /* for tty names */
    #define UT_HOSTSIZE     128 /* for longer FQDN's */
    #define UT_IDSIZE       UT_LINESIZE
    struct utmpx {
            char    ut_line[UT_LINESIZE];
            char    ut_user[UT_NAMESIZE];
            char    ut_host[UT_HOSTSIZE];
            struct timeval ut_tv;
            pid_t   ut_pid;
            uid_t   ut_uid;            /* Real uid of user process */
            char    ut_id[UT_IDSIZE];  /* Repeats ut_line */
            short   ut_type;           /* Type of entry; see macros above */
            struct exit_status ut_exit;  /* DEAD_PROCESS exit information */
    };

    The login(1) program opens the file utmpx and inserts the utmpx record for
    the user. This record remains there until the user logs out, at which time
    it is deleted. The utmpx file is used by who(1).

    Next, the login(1) program opens the file wtmpx, and appends the user's
    utmpx record. The same utmpx record, with an updated time stamp is later
    appended to the file when the user logs out. The wtmpx file is used by the
    program last(1).

    In the event of a date change, a shutdown, or a reboot, the following
    items are logged in the wtmpx file:

    reboot

    shutdown
        A system reboot or shutdown has been initiated. The character ~ is
        placed in the field ut_line, and or in the field ut_name.

    date
        The system time has been manually or automatically updated. (See
        date(1).) The command name date(1) is recorded in the field ut_name.
        In the field ut_line, the character | indicates the time prior to the
        change, and the character { indicates the new time.

  FILES

    /var/adm/utmpx
        The utmpx file.

    /var/adm/wtmpx
        The wtmpx file.

    /var/log/lastlog
        The lastlog file.

  SEE ALSO

    last(1)

    login(1)

    who(1)