utmp
and
wtmp
,
the extended databases in
utmpx
and
wtmpx
reserve more space for logging hostnames, and also
information on a process' ID, termination signal and exit status.
The
<utmpx.h
>
header defines the structures and functions for logging user.
Currently logged in users are tracked in
/var/run/utmpx
,
a list of all logins and logouts, as well as all shutdowns, reboots
and date changes, is kept in
/var/log/wtmpx
,
and the last login of each user is noted in
/var/log/lastlogx
.
The interface to the utmpx file is described in getutxent(3).
The wtmpx file can grow rapidly on busy systems, and is normally rotated with newsyslog(8).
In the event of a date change, a shutdown, or a reboot, the following items are logged in the wtmpx file:
date
ut_name
.
In the field
ut_line
,
the character
`'
indicates the time prior to the change, and the character
`{'
indicates the new time.
reboot
shutdown
ut_line
,
and
reboot
or
shutdown
in the field
ut_name
(see
shutdown(8)
and
reboot(8)),
using
logwtmpx(3).
/var/run/utmpx
/var/log/wtmpx
/var/log/lastlogx