utmp, wtmp, failedlogin File Format
Purpose
Describes formats for user and accounting information.
Description
The utmp file, the wtmp file, and the failedlogin file contain records with user and accounting information.
When a user attempts to logs in, the login program writes entries in two files:
- The /etc/utmp file, which contains a record of users logged into the system.
- The /var/adm/wtmp file (if it exists), which contains connect-time accounting records.
On an invalid login attempt, due to an incorrect login name or password, the login program makes an entry in:
- The /etc/security/failedlogin file, which contains a record of unsuccessful login attempts.
The records in these files follow the utmp format, defined in the utmp.h header file.
Files
| Item | Description |
|---|---|
| /etc/utmp | Contains a record of users logged into the system. |
| /var/adm/wtmp | Contains connect accounting information. |
| /etc/security/failedlogin | Contains a record of invalid login attempts. |