Copyright (c) 2002 The NetBSD Foundation, Inc.
All rights reserved.
This code is derived from software contributed to The NetBSD Foundation
by Thomas Klausner.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
.Dd January 31, 2007 .Dt UTMPX 5 .Os .Sh NAME .Nm utmpx , .Nm wtmpx , .Nm lastlogx .Nd user accounting database .Sh SYNOPSIS n utmpx.h .Sh DESCRIPTION In contrast to
a utmp and
a wtmp , the extended databases in
a utmpx and
a wtmpx reserve more space for logging hostnames, and also information on a process' ID, termination signal and exit status.
p The n utmpx.h header defines the structures and functions for logging user. Currently logged in users are tracked in
a /var/run/utmpx , a list of all logins and logouts, as well as all shutdowns, reboots and date changes, is kept in
a /var/log/wtmpx , and the last login of each user is noted in
p The interface to the .Nm utmpx file is described in .Xr getutxent 3 .
p The .Nm wtmpx file can grow rapidly on busy systems, and is normally rotated with .Xr newsyslog 8 .
p In the event of a date change, a shutdown, or a reboot, the following items are logged in the .Nm wtmpx file: l -tag -width shutdownxx -compact -offset indent t Li date The system time has been manually or automatically updated by .Xr date 1 . The command name .Em date is recorded in the field .Fa ut_name . In the field .Fa ut_line , the character .Ql \\*(Ba indicates the time prior to the change, and the character .Ql { indicates the new time. t Li reboot t Li shutdown A system reboot or shutdown has been initiated. The character .Ql ~ is placed in the field .Fa ut_line , and .Li reboot or .Li shutdown in the field .Fa ut_name (see .Xr shutdown 8 and .Xr reboot 8 ) , using .Xr logwtmpx 3 .
p .El .Sh FILES l -tag -width /var/log/lastlogx -compact t Pa /var/run/utmpx The .Nm utmpx file. t Pa /var/log/wtmpx The .Nm wtmpx file. t Pa /var/log/lastlogx The .Nm lastlogx file. .El .Sh SEE ALSO .Xr last 1 , .Xr login 1 , .Xr rwho 1 , .Xr w 1 , .Xr who 1 , .Xr endutxent 3 , .Xr logwtmpx 3 , .Xr utmp 5 , .Xr ac 8 , .Xr init 8 , .Xr newsyslog 8 , .Xr reboot 8
Indexes created Sun Sep 21 15:09:59 GMT 2025