Varlogwtmp

Varlogwtmp refers to the binary log file used by Unix-like systems to record login activity and related system events. Located at /var/log/wtmp, it provides a historical ledger of user sessions, including logins, logouts, and boot or shutdown events. The file is written by programs that establish or terminate sessions, such as login, sshd, and system startup processes.

Content and format: Wtmp is a binary file defined by the utmp/wtmp data structures in the system C library. Each record typically contains the event type (for example, USER_PROCESS or BOOT_TIME), the username, the terminal line, the remote host (if applicable), the process ID, and a timestamp. Because it is a binary format, direct viewing is not human-friendly; specialized tools are used to interpret it.

Reading and interpretation: Utilities such as last read /var/log/wtmp to show a historical sequence of logins and logouts. The last command can also summarize session durations and user activity. For failed logins, a separate file (btmp) is used, read by similar tools. For low-level inspection, programs like utmpdump can dump wtmp records into a readable form.

Maintenance and privacy: Wtmp files grow over time and are typically rotated by system log management to prevent unbounded growth. New files are created while older ones are preserved (e.g., wtmp.1, etc.). Access is typically restricted to privileged users, but on many systems it is world-readable for auditing, which raises privacy considerations since it may reveal user names and remote hosts.

See also: utmp, wtmp, last, lastb, logrotate, utmpdump.