January 31, 2007 UTMPX 5

### NAME

utmpx, wtmpx, lastlogx - user accounting database

### SYNOPSIS

### DESCRIPTION

In contrast to ```utmp` and ```wtmp`, the extended databases in ```utmpx` and ```wtmpx` reserve more space for logging hostnames, and also information on a process' ID, termination signal and exit status.

The <```utmpx.h`> header defines the structures and functions for logging user. Currently logged in users are tracked in ```/var/run/utmpx`, a list of all logins and logouts, as well as all shutdowns, reboots and date changes, is kept in ```/var/log/wtmpx`, and the last login of each user is noted in ```/var/log/lastlogx`.

The interface to the utmpx file is described in getutxent(3).

The wtmpx file can grow rapidly on busy systems, and is normally rotated with newsyslog(8).

In the event of a date change, a shutdown, or a reboot, the following items are logged in the wtmpx file:

```date`
  The system time has been manually or automatically updated by date(1). The command name date is recorded in the field ```ut_name`. In the field ```ut_line`, the character `' indicates the time prior to the change, and the character `{' indicates the new time.
```reboot`
```shutdown`
  A system reboot or shutdown has been initiated. The character `~' is placed in the field ```ut_line`, and ```reboot` or ```shutdown` in the field ```ut_name` (see shutdown(8) and reboot(8)), using logwtmpx(3).

### FILES

```/var/run/utmpx`
  The utmpx file.
```/var/log/wtmpx`
  The wtmpx file.
```/var/log/lastlogx`
  The lastlogx file.

### SEE ALSO

last(1), login(1), rwho(1), w(1), who(1), endutxent(3), logwtmpx(3), utmp(5), ac(8), init(8), newsyslog(8), reboot(8)