In contrast to
utmp and
wtmp, the extended databases in
utmpx and
wtmpx reserve more space for logging hostnames, and also information on a process' ID, termination signal and exit status.
The
<utmpx.h> header defines the structures and functions for logging user. Currently logged in users are tracked in
/var/run/utmpx, a list of all logins and logouts, as well as all shutdowns, reboots and date changes, is kept in
/var/log/wtmpx, and the last login of each user is noted in
/var/log/lastlogx.
The interface to the
utmpx file is described in
getutxent(3).
The
wtmpx file can grow rapidly on busy systems, and is normally rotated with
newsyslog(8).
In the event of a date change, a shutdown, or a reboot, the following items are logged in the
wtmpx file:
date
The system time has been manually or automatically updated by
date(1). The command name
date is recorded in the field
ut_name. In the field
ut_line, the character ‘\*(Ba' indicates the time prior to the change, and the character ‘{' indicates the new time.
shutdown
A system reboot or shutdown has been initiated. The character ‘~' is placed in the field
ut_line, and
reboot or
shutdown in the field
ut_name (see
shutdown(8) and
reboot(8)), using
logwtmpx(3).