utmp

utmp is a binary file used by Unix-like operating systems to record information about currently active user sessions and certain system events. It enables utilities such as who, w, and users to report who is logged in and from where. Each entry in utmp represents an active user process associated with a terminal and includes the user name, terminal line, host name, login timestamp, and the process ID of the session. In addition to user sessions, utmp may include system events such as boot time and run level changes, depending on the implementation.

Historically located at /var/run/utmp; on many Linux systems it is at /run/utmp (with /var/run typically a symlink to /run). The file is updated by login programs, initialization processes, and session managers, and is read by user-facing programs. Applications use the Unix utmp interfaces provided by the C library, such as getutent, getutid, getutline, pututline, setutent, and endutent, to read or modify entries in a controlled manner.

Related files include wtmp, which records a historical log of logins and logouts, and btmp, which records failed login attempts. Security and integrity of utmp are maintained by file permissions and, on some systems, by log rotation to prevent unbounded growth.