utmp(5)

NAME
     utmp, wtmp - logged in users, login and logout history

SYNOPSIS
     #include <sys/types.h>
     #include <utmp.h>

DESCRIPTION
     The files /etc/utmp and /usr/adm/wtmp respectively contain the  currently
     logged in users, and the history of logins and logouts.

     Each file is an array of the following structure defined in <utmp.h>:

     struct utmp {
          char           ut_user[8];    /* user name */
          char           ut_line[12];   /* terminal name */
          char           ut_host[16];   /* host name, when remote */
          time_t         ut_time;       /* login/logout time */
     };

     #define ut_name ut_user /* for compatibility with other systems */

     The structure contains more fields than those listed, but they  are  only
     of  interest  to  init  and  login.   Note  that  the  ut_name field is a
     compatibility alias for ut_user, it is actually better to use it.

     A login entry is completely specified.  A logout entry has a null  string
     for  ut_name.  A shutdown or reboot entry has an ut_line field containing
     a "~" (tilde).  The ut_name field is usually the name of the program that
     did  the  shutdown,  or "reboot" at reboot.  This is a bit confusing, but
     note that there should always be two such entries.  If you see  just  one
     entry then the system has crashed, if you see two entries then the system
     was properly shut down and later rebooted.

FILES

     /etc/utmp                Currently logged in users.

     /usr/adm/wtmp            History of logins and logouts.

SEE ALSO
     who(1), ttyslot(3).

AUTHOR
     Kees J. Bot (kjb@cs.vu.nl)