{
    "mode": "info",
    "parameter": "utmp",
    "section": "",
    "url": "https://www.chedong.com/phpMan.php/info/utmp/json",
    "generated": "2026-08-03T03:17:06Z",
    "synopsis": "#include <utmp.h>",
    "sections": {
        "NAME": {
            "content": "utmp, wtmp - login records\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "#include <utmp.h>\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "The utmp file allows one to discover information about who is currently\nusing the system.  There may be more users currently using the  system,\nbecause not all programs use utmp logging.\n\nWarning:  utmp  must not be writable by the user class \"other\", because\nmany system programs (foolishly) depend on  its  integrity.   You  risk\nfaked  system  logfiles  and modifications of system files if you leave\nutmp writable to any user other than the owner and group owner  of  the\nfile.\n\nThe  file  is  a  sequence  of  utmp structures, declared as follows in\n<utmp.h> (note that this is only one of several definitions around; de-\ntails depend on the version of libc):\n\n/* Values for uttype field, below */\n\n#define EMPTY         0 /* Record does not contain valid info\n(formerly known as UTUNKNOWN on Linux) */\n#define RUNLVL       1 /* Change in system run-level (see\ninit(1)) */\n#define BOOTTIME     2 /* Time of system boot (in uttv) */\n#define NEWTIME      3 /* Time after system clock change\n(in uttv) */\n#define OLDTIME      4 /* Time before system clock change\n(in uttv) */\n#define INITPROCESS  5 /* Process spawned by init(1) */\n#define LOGINPROCESS 6 /* Session leader process for user login */\n#define USERPROCESS  7 /* Normal process */\n#define DEADPROCESS  8 /* Terminated process */\n#define ACCOUNTING    9 /* Not implemented */\n\n#define UTLINESIZE      32\n#define UTNAMESIZE      32\n#define UTHOSTSIZE     256\n\nstruct exitstatus {              /* Type for utexit, below */\nshort etermination;          /* Process termination status */\nshort eexit;                 /* Process exit status */\n};\n\nstruct utmp {\nshort   uttype;              /* Type of record */\npidt   utpid;               /* PID of login process */\nchar    utline[UTLINESIZE]; /* Device name of tty - \"/dev/\" */\nchar    utid[4];             /* Terminal name suffix,\nor inittab(5) ID */\nchar    utuser[UTNAMESIZE]; /* Username */\nchar    uthost[UTHOSTSIZE]; /* Hostname for remote login, or\nkernel version for run-level\nmessages */\nstruct  exitstatus utexit;  /* Exit status of a process\nmarked as DEADPROCESS; not\nused by Linux init(1) */\n/* The utsession and uttv fields must be the same size when\ncompiled 32- and 64-bit.  This allows data files and shared\nmemory to be shared between 32- and 64-bit applications. */\n#if WORDSIZE == 64 && defined WORDSIZECOMPAT32\nint32t utsession;           /* Session ID (getsid(2)),\nused for windowing */\nstruct {\nint32t tvsec;           /* Seconds */\nint32t tvusec;          /* Microseconds */\n} uttv;                      /* Time entry was made */\n#else\nlong   utsession;           /* Session ID */\nstruct timeval uttv;        /* Time entry was made */\n#endif\n\nint32t utaddrv6[4];        /* Internet address of remote\nhost; IPv4 address uses\njust utaddrv6[0] */\nchar unused[20];            /* Reserved for future use */\n};\n\n/* Backward compatibility hacks */\n#define utname utuser\n#ifndef NOUTTIME\n#define uttime uttv.tvsec\n#endif\n#define utxtime uttv.tvsec\n#define utaddr utaddrv6[0]\n\nThis  structure  gives the name of the special file associated with the\nuser's terminal, the user's login name, and the time of  login  in  the\nform of time(2).  String fields are terminated by a null byte ('\\0') if\nthey are shorter than the size of the field.\n\nThe first entries ever created result  from  init(1)  processing  init-\ntab(5).   Before  an entry is processed, though, init(1) cleans up utmp\nby setting uttype to  DEADPROCESS,  clearing  utuser,  uthost,  and\nuttime   with  null  bytes  for  each  record  which  uttype  is  not\nDEADPROCESS or RUNLVL and where no process with  PID  utpid  exists.\nIf  no empty record with the needed utid can be found, init(1) creates\na new one.  It sets utid from the inittab, utpid and uttime  to  the\ncurrent values, and uttype to INITPROCESS.\n\nmingetty(8)  (or  agetty(8))  locates  the  entry  by  the PID, changes\nuttype to LOGINPROCESS, changes uttime, sets utline, and waits  for\nconnection  to be established.  login(1), after a user has been authen-\nticated, changes uttype to USERPROCESS,  changes  uttime,  and  sets\nuthost  and  utaddr.  Depending on mingetty(8) (or agetty(8)) and lo-\ngin(1), records may be located by utline  instead  of  the  preferable\nutpid.\n\nWhen init(1) finds that a process has exited, it locates its utmp entry\nby utpid, sets uttype to DEADPROCESS, and clears  utuser,  uthost,\nand uttime with null bytes.\n\nxterm(1)  and  other  terminal emulators directly create a USERPROCESS\nrecord and generate the utid by using the string that suffix  part  of\nthe terminal name (the characters following /dev/[pt]ty).  If they find\na DEADPROCESS for this ID, they recycle it, otherwise  they  create  a\nnew  entry.   If they can, they will mark it as DEADPROCESS on exiting\nand it is advised that they null utline, uttime, utuser, and uthost\nas well.\n\ntelnetd(8)  sets  up  a  LOGINPROCESS entry and leaves the rest to lo-\ngin(1) as usual.  After the telnet session ends, telnetd(8)  cleans  up\nutmp in the described way.\n\nThe  wtmp  file  records all logins and logouts.  Its format is exactly\nlike utmp except that a null username indicates a logout on the associ-\nated terminal.  Furthermore, the terminal name ~ with username shutdown\nor reboot indicates a system shutdown or reboot and the pair of  termi-\nnal  names  |/}  logs  the old/new system time when date(1) changes it.\nwtmp is maintained by login(1), init(1), and some versions of  getty(8)\n(e.g.,  mingetty(8)  or agetty(8)).  None of these programs creates the\nfile, so if it is removed, record-keeping is turned off.\n",
            "subsections": []
        },
        "FILES": {
            "content": "/var/run/utmp\n/var/log/wtmp\n",
            "subsections": []
        },
        "CONFORMING TO": {
            "content": "POSIX.1 does not specify a utmp structure, but rather one named  utmpx,\nwith  specifications  for  the  fields uttype, utpid, utline, utid,\nutuser, and uttv.  POSIX.1  does  not  specify  the  lengths  of  the\nutline and utuser fields.\n\nLinux defines the utmpx structure to be the same as the utmp structure.\n\nComparison with historical systems\nLinux  utmp entries conform neither to v7/BSD nor to System V; they are\na mix of the two.\n\nv7/BSD has fewer fields;  most  importantly  it  lacks  uttype,  which\ncauses native v7/BSD-like programs to display (for example) dead or lo-\ngin entries.  Further, there is no configuration file  which  allocates\nslots to sessions.  BSD does so because it lacks utid fields.\n\nIn  Linux  (as  in  System  V),  the utid field of a record will never\nchange once it has been set, which reserves that slot without needing a\nconfiguration file.  Clearing utid may result in race conditions lead-\ning to corrupted utmp entries and potential security  holes.   Clearing\nthe  abovementioned  fields  by filling them with null bytes is not re-\nquired by System V semantics, but makes it possible to  run  many  pro-\ngrams  which  assume BSD semantics and which do not modify utmp.  Linux\nuses the BSD conventions for line contents, as documented above.\n\nSystem V has no uthost or utaddrv6 fields.\n",
            "subsections": []
        },
        "NOTES": {
            "content": "Unlike various other systems, where utmp logging can be disabled by re-\nmoving  the file, utmp must always exist on Linux.  If you want to dis-\nable who(1), then do not make utmp world readable.\n\nThe file format is machine-dependent, so it is recommended that  it  be\nprocessed only on the machine architecture where it was created.\n\nNote  that  on  biarch  platforms,  that is, systems which can run both\n32-bit and 64-bit applications (x86-64, ppc64, s390x, etc.),  uttv  is\nthe  same  size  in  32-bit  mode as in 64-bit mode.  The same goes for\nutsession and uttime if they are present.  This allows data files and\nshared  memory  to  be  shared  between 32-bit and 64-bit applications.\nThis is achieved by changing the type of  utsession  to  int32t,  and\nthat  of  uttv to a struct with two int32t fields tvsec and tvusec.\nSince uttv may not be the same as struct timeval, then instead of  the\ncall:\n\ngettimeofday((struct timeval *) &ut.uttv, NULL);\n\nthe following method of setting this field is recommended:\n\nstruct utmp ut;\nstruct timeval tv;\n\ngettimeofday(&tv, NULL);\nut.uttv.tvsec = tv.tvsec;\nut.uttv.tvusec = tv.tvusec;\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "ac(1),  date(1),  init(1),  last(1), login(1), logname(1), lslogins(1),\nusers(1), utmpdump(1), who(1), getutent(3), getutmp(3),  login(3),  lo-\ngout(3), logwtmp(3), updwtmp(3)\n",
            "subsections": []
        },
        "COLOPHON": {
            "content": "This  page  is  part of release 5.10 of the Linux man-pages project.  A\ndescription of the project, information about reporting bugs,  and  the\nlatest     version     of     this    page,    can    be    found    at\nhttps://www.kernel.org/doc/man-pages/.\n\nLinux                             2020-12-21                           UTMP(5)",
            "subsections": []
        }
    },
    "summary": "utmp, wtmp - login records",
    "flags": [],
    "examples": [],
    "see_also": [
        {
            "name": "ac",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/ac/1/json"
        },
        {
            "name": "date",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/date/1/json"
        },
        {
            "name": "init",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/init/1/json"
        },
        {
            "name": "last",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/last/1/json"
        },
        {
            "name": "login",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/login/1/json"
        },
        {
            "name": "logname",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/logname/1/json"
        },
        {
            "name": "lslogins",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/lslogins/1/json"
        },
        {
            "name": "users",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/users/1/json"
        },
        {
            "name": "utmpdump",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/utmpdump/1/json"
        },
        {
            "name": "who",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/who/1/json"
        },
        {
            "name": "getutent",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/getutent/3/json"
        },
        {
            "name": "getutmp",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/getutmp/3/json"
        },
        {
            "name": "login",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/login/3/json"
        },
        {
            "name": "gout",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/gout/3/json"
        },
        {
            "name": "logwtmp",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/logwtmp/3/json"
        },
        {
            "name": "updwtmp",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/updwtmp/3/json"
        }
    ]
}