wtmp

wtmp is a binary log file used by Unix-like operating systems to record user session events and related system activity. It provides a historical record of logins, logouts, reboots, and other session-related events for auditing, accounting, and troubleshooting. On most systems the file is located at /var/log/wtmp, though location and rotation policies can vary.

Because wtmp is binary, it is not meant to be read directly with a text editor. System utilities read its records to reconstruct history. Common tools that rely on wtmp include last, which shows a chronological list of past user sessions, and lastb, which reports failed login attempts. Other programs such as who or w may use utmp for current session information, while last and related tools interpret wtmp for historical data. Each record typically contains a timestamp, a username, a terminal or device name, and a host or IP address, along with an event type indicating login, logout, boot, or shutdown.

Related files include utmp, which tracks currently active user sessions in real time, usually at /var/run/utmp, and btmp, which records failed login attempts. These files are read by different utilities and have different purposes in system auditing and monitoring.

Rotation and retention of wtmp are commonly managed by the system’s log rotation framework. As the file grows, older records may be archived and a new wtmp file started to prevent unbounded growth. Access to wtmp is controlled by filesystem permissions, reflecting its potential sensitivity as a record of user activity.