Chapter 40: Login Accounting
Login accounting is concerned with recording which users are currently logged in to
the system, and recording past logins and logouts. This chapter looks at the login
accounting files and the library functions used to retrieve and update the informa-
tion they contain. We also describe the steps that an application providing a login ser-
vice should perform in order to update these files when a user logs in and out.40.1 Overview of the utmp and wtmp Files
UNIX systems maintain two data files containing information about users logging
in and out of the system:
z The utmp file maintains a record of users currently logged in to the system (as
well as certain other information that we describe later). As each user logs in, a
record is written to the utmp file. One of the fields in this record, ut_user,
records the login name of the user. This record is later erased on logout. Pro-
grams such as who(1) use the information in the utmp file to display a list of cur-
rently logged-in users.
z The wtmp file is an audit trail of all user logins and logouts (as well as certain
other information that we describe later). On each login, a record containing
the same information as is written to the utmp file is appended to the wtmp file.
On logout, a further record is appended to the file. This record contains the
same information, except that the ut_user field is zeroed out. The last(1) com-
mand can be used to display and filter the contents of the wtmp file.