utmpx — Format of login accounting files

Login accounting information is stored in two files:

• /etc/utmpx holds the current state of each item being accounted
• /etc/wtmp maintains the history of changes to each accounting item

Both files are arrays of the following binary records described in the form of a C data structure:

#include <sys/types.h>

struct utmpx                                                                                
 {                                                                                          
   char ut_user[9] ;               /* user login name */                                    
   char ut_id[34] ;                /* unspecified initialization process ID */              
   char ut_line[33] ;              /* device name */                                        
   pid_t ut_pid ;                  /* process id */                                         
   short int ut_type ;             /* type of entry */                                      
   short int ut_version;           /* LE runtime level when boot record is written */       
   #ifndef _LP64                                                                            
     struct timeval     ut_tv;     /* time entry was made */                                
   #else                                                                                    
     struct __timeval32 ut_tv32;   /* time entry was made */                                
   #endif                                                                                   
   struct ut_exit_status {                                                                  
      short ut_e_termination;      /* Process termination status */                         
      short ut_e_exit ;            /* Process exit status */                                
     }                                                                                      
   ut_exit ;                       /* The exit status of process markedDEAD_PROCESS. */     
   unsigned short ut_reserved1;    /* Reserved for future use */                            
   char ut_host[1024] ;            /* host name, if remote */                               
   #ifdef _LP64                                                                             
      struct timeval      ut_tv;   /* time entry was made */                                
   #else                                                                                    
      struct __timeval64  ut_tv64; /* time entry was made */                                
   #endif                                                                                   
 } ;                                                                                        

#define EMPTY         0   /* Unused */
#define RUN_LVL       1   /* Set new run level */
#define BOOT_TIME     2   /* System boot */
#define OLD_TIME      3   /* Time of date change - delta */
#define NEW_TIME      4   /* Time of date change + delta */
#define INIT_PROCESS  5   /* Process started by &[.ETCDIR]/init */
#define LOGIN_PROCESS 6   /* Login process */
#define USER_PROCESS  7   /* User process */
#define DEAD_PROCESS  8   /* Contains exit status */
#define ACCOUNTING    9   /* Other accounting */