utmp
and
wtmp,
the extended databases in
utmpx
and
wtmpx
reserve more space for logging hostnames, and also
information on a process' ID, termination signal and exit status.
The
<utmpx.h>
header defines the structures and functions for logging user.
Currently logged in users are tracked in
/var/run/utmpx,
a list of all logins and logouts, as well as all shutdowns, reboots
and date changes, is kept in
/var/log/wtmpx,
and the last login of each user is noted in
/var/log/lastlogx.
The interface to the utmpx file is described in getutxent(3).
The wtmpx file can grow rapidly on busy systems, and is normally rotated with newsyslog(8).
In the event of a date change, a shutdown, or a reboot, the following items are logged in the wtmpx file:
dateut_name.
In the field
ut_line,
the character
`'
indicates the time prior to the change, and the character
`{'
indicates the new time.
rebootshutdownut_line,
and
reboot
or
shutdown
in the field
ut_name
(see
shutdown(8)
and
reboot(8)),
using
logwtmpx(3).
/var/run/utmpx/var/log/wtmpx/var/log/lastlogx