utmp(5) File Formats Manual utmp(5) utmp, wtmp - #include utmp . utmp. : utmp "" ( ) . utmp . utmp ( libc): /* Values for ut_type field, below */ #define EMPTY 0 /* Record does not contain valid info (formerly known as UT_UNKNOWN on Linux) */ #define RUN_LVL 1 /* Change in system run-level (see init(1)) */ #define BOOT_TIME 2 /* Time of system boot (in ut_tv) */ #define NEW_TIME 3 /* Time after system clock change (in ut_tv) */ #define OLD_TIME 4 /* Time before system clock change (in ut_tv) */ #define INIT_PROCESS 5 /* Process spawned by init(1) */ #define LOGIN_PROCESS 6 /* Session leader process for user login */ #define USER_PROCESS 7 /* Normal process */ #define DEAD_PROCESS 8 /* Terminated process */ #define ACCOUNTING 9 /* Not implemented */ #define UT_LINESIZE 32 #define UT_NAMESIZE 32 #define UT_HOSTSIZE 256 struct exit_status { /* Type for ut_exit, below */ short e_termination; /* Process termination status */ short e_exit; /* Process exit status */ }; struct utmp { short ut_type; /* Type of record */ pid_t ut_pid; /* PID of login process */ char ut_line[UT_LINESIZE]; /* Device name of tty - "/dev/" */ char ut_id[4]; /* Terminal name suffix, or inittab(5) ID */ char ut_user[UT_NAMESIZE]; /* Username */ char ut_host[UT_HOSTSIZE]; /* Hostname for remote login, or kernel version for run-level messages */ struct exit_status ut_exit; /* Exit status of a process marked as DEAD_PROCESS; not used by Linux init(1) */ /* The ut_session and ut_tv fields must be the same size when compiled 32- and 64-bit. This allows data files and shared memory to be shared between 32- and 64-bit applications. */ #if __WORDSIZE == 64 && defined __WORDSIZE_COMPAT32 int32_t ut_session; /* Session ID ( getsid(2)), used for windowing */ struct { int32_t tv_sec; /* Seconds */ int32_t tv_usec; /* Microseconds */ } ut_tv; /* Time entry was made */ #else long ut_session; /* Session ID */ struct timeval ut_tv; /* Time entry was made */ #endif int32_t ut_addr_v6[4]; /* Internet address of remote host; IPv4 address uses just ut_addr_v6[0] */ char __unused[20]; /* Reserved for future use */ }; /* Backward compatibility hacks */ #define ut_name ut_user #ifndef _NO_UT_TIME #define ut_time ut_tv.tv_sec #endif #define ut_xtime ut_tv.tv_sec #define ut_addr ut_addr_v6[0] time(2). ('\0') . init(1) inittab(5). init(1) utmp ut_type DEAD_PROCESS ut_user ut_host ut_time ut_type DEAD_PROCESS RUN_LVL PID ut_pid. ut_id init(1) . ut_id inittab ut_pid ut_time ut_type INIT_PROCESS. mingetty(8) ( agetty(8)) PID ut_type LOGIN_PROCESS ut_time ut_line . login(1) ut_type USER_PROCESS ut_time ut_host ut_addr. mingetty(8) ( agetty(8)) login(1) ut_line ut_pid . init(1) utmp ut_pid ut_type DEAD_PROCESS ut_user ut_host ut_time . xterm(1) USER_PROCESS ut_id ( /dev/[pt]ty). DEAD_PROCESS . DEAD_PROCESS ut_line ut_time ut_user ut_host . telnetd(8) LOGIN_PROCESS login(1) . telnet telnetd(8) utmp . wtmp . utmp . ~ shutdown reboot |/} / date(1). wtmp login(1) init(1) getty(8) ( mingetty(8) agetty(8)). . /var/run/utmp /var/log/wtmp POSIX.1 utmp utmpx ( XSI) ut_type ut_pid ut_line ut_id ut_user ut_tv. POSIX.1 ut_line ut_user. utmpx utmp. . utmp v7/BSD System V . v7/BSD ut_type v7/BSD ( ) . . BSD ut_id. ( System V) ut_id . ut_id (race conditions) utmp . (null bytes) System V BSD utmp. BSD . System V ut_host ut_addr_v6. utmp utmp . who(1) (world readable). . biarch 32- 64- (x86-64, ppc64, s390x ) ut_tv 32- 64-. ut_session ut_time . 32- 64-. ut_session int32_t ut_tv int32_t tv_sec tv_usec. ut_tv struct timeval : gettimeofday((struct timeval *) &ut.ut_tv, NULL); : struct utmp ut; struct timeval tv; gettimeofday(&tv, NULL); ut.ut_tv.tv_sec = tv.tv_sec; ut.ut_tv.tv_usec = tv.tv_usec; ac(1), date(1), init(1), last(1), login(1), logname(1), lslogins(1), users(1), utmpdump(1), who(1), getutent(3), getutmp(3), login(3), logout(3), logwtmp(3), updwtmp(3) 3 . . : . 6.18 21 2025 utmp(5)