UTMP(5,F)                   AIX Technical Reference                   UTMP(5,F)



-------------------------------------------------------------------------------
utmp, wtmp, .ilog



PURPOSE

Contains user and accounting information.

SYNOPSIS

#include <utmp.h>

DESCRIPTION

When a user logs in successfully, the login program writes entries in
/etc/utmp, the record of users logged into the system, and in /usr/adm/wtmp (if
it exists), for use in accounting.  On invalid login attempts (due to an
incorrect login name or password), login makes entries in the /etc/.ilog file.
When you log in as user root or su and the /etc/.ilog file is not empty, you
see a message advising you to check the /etc/.ilog file for a record of
unsuccessful login attempts.

If the Transparent Computing Facility is installed, there is a unique /etc/utmp
and a unique /usr/adm/wtmp for each cluster site (/etc/utmp and /usr/adm/wtmp
are symbolic links into the local file system).

The records in these files follow the utmp structure, which is defined in the
utmp.h header file:

     #define UTMP_FILE  "/etc/utmp"
     #define WTMP_FILE  "/usr/adm/wtmp"
     #define ILOG_FILE  "/etc/.ilog"

     #define ut_name  ut_user

     struct utmp
       {
          char ut_user[8];         /* User login name */
          char ut_id[6];           /* id from /etc/inittab */
          char ut_line[12];        /* device name (console, ttyx) */
          pid_t ut_pid;            /* process id */
          short  ut_type;          /* type of entry */
          struct exit_status
            {
             short e_termination;  /* Process termination status */
             short e_exit;         /* Process exit status */
            }
          ut_exit;                 /* The exit status of a process */
                                   /* marked as DEAD_PROCESS. */
          time_t  ut_time;         /* time entry was made */
          char   ut_host[16];      /* host name if remote login */



Processed November 7, 1990         UTMP(5,F)                                  1

UTMP(5,F)                   AIX Technical Reference                   UTMP(5,F)



          long   ut_lsite;         /* reserved */
          datarep_t ut_datarep[4]; /* reserved */
  };


     /* Definitions for ut_type */

     #define EMPTY           0
     #define RUN_LVL        1
     #define BOOT_TIME      2
     #define OLD_TIME       3
     #define NEW_TIME       4
     #define INIT_PROCESS   5     /* Process spawned by "init" */
     #define LOGIN_PROCESS  6     /* A "getty" process waiting for login */
     #define USER_PROCESS   7     /* A user process */
     #define DEAD_PROCESS   8
     #define ACCOUNTING      9
     #define UTMAXTYPE ACCOUNTING  /* Largest legal value of ut_type */

     /* Special strings or formats used in the "ut_line" field when */
     /* accounting for something other than a process. */
     /* No string for the ut_line field can be more than 11 chars + */
     /* a NULL in length. */

     #define RUNLVL_MSG     "run-level ?"
     #define BOOT_MSG       "system boot"
     #define OTIME_MSG      "old time"
     #define NTIME_MSG      "new time"

FILES

/etc/utmp        Record of users logged into the system
/usr/adm/wtmp    Accounting information
/etc/.ilog       Record of invalid logins.

The ut_datarep field has the value DR_LOCAL_FORMAT.  This value encodes the CPU
byte ordering for the machine on which the entry was created.  This value is
different for AIX/370 and AIX PS/2.

RELATED INFORMATION

The login, who, and write commands in AIX Operating System Commands Reference.













Processed November 7, 1990         UTMP(5,F)                                  2