UTMPX(5) | File Formats Manual | UTMPX(5)

# NAME

`utmpx`, `wtmpx`, `lastlogx` —
user accounting database

# SYNOPSIS

`#include <utmpx.h>`

# DESCRIPTION

In contrast to utmp and wtmp, the extended databases in utmpx and wtmpx reserve more space for logging hostnames, and also information on a process' ID, termination signal and exit status.

The `<utmpx.h>` header defines the structures and functions for logging user. Currently logged in users are tracked in /var/run/utmpx, a list of all logins and logouts, as well as all shutdowns, reboots and date changes, is kept in /var/log/wtmpx, and the last login of each user is noted in /var/log/lastlogx.

The interface to the `utmpx` file is described in getutxent(3).

The `wtmpx` file can grow rapidly on busy systems, and is normally rotated with newsyslog(8).

In the event of a date change, a shutdown, or a reboot, the following items are logged in the `wtmpx` file:

`date`
  The system time has been manually or automatically updated by date(1). The command name date is recorded in the field ut_name. In the field ut_line, the character ‘`|`’ indicates the time prior to the change, and the character ‘`{`’ indicates the new time.
`reboot`
`shutdown`
  A system reboot or shutdown has been initiated. The character ‘`~`’ is placed in the field ut_line, and `reboot` or `shutdown` in the field ut_name (see shutdown(8) and reboot(8)), using logwtmpx(3).

# FILES

/var/run/utmpx
  The `utmpx` file.
/var/log/wtmpx
  The `wtmpx` file.
/var/log/lastlogx
  The `lastlogx` file.

# SEE ALSO

last(1), login(1), rwho(1), w(1), who(1), endutxent(3), logwtmpx(3), utmp(5), ac(8), init(8), newsyslog(8), reboot(8)

January 31, 2007 | NetBSD 10.1