topic Re: wtmps access in Operating System - Linux

wtmps access

Pradeep Singh — Thu, 14 Jul 2005 17:49:56 GMT

How can I access /var/adm/wtmps programatically ? I have tried the structure in utmps.h and also getutsent() functions, but no valid entries are reported.

Is there any other way to get the same output as the "last" command but with the "YEAR" information in the date field ?

Any help will be appreciated.

Re: wtmps access

Tom Schroll — Fri, 15 Jul 2005 07:37:50 GMT

Do you mean /var/adm/wtmp or /var/adm/wtmpx? I don't seem to see any /var/adm/wtmps file.

Please clarify.

Thanks...

-- Tom

Re: wtmps access

Patrick Wallek — Fri, 15 Jul 2005 07:54:47 GMT

The year information is NOT stored in the wtmp or btmp files.

You should periodically clear out the files so you KNOW exactly when someone logged in.

Re: wtmps access

Devender Khatana — Sat, 16 Jul 2005 08:15:27 GMT

Hi Pradeep,

The system auditing requires to be carried out periodically & these logs should be cleared out alongwith that. Otherwise also viewing a information older than few months did not achive much.

If still you require you utilize this information for that than all your entries are visible in the output in descending order sorted by date. So you should be easily able to differentiate in multiple entries of same month in two different years.

HTH,
Devender

Re: wtmps access

Ermin Borovac — Sun, 17 Jul 2005 22:50:02 GMT

wtmps is used on 11.23 so I assume that you are running that version of hp-ux. /usr/sbin/acct/fwtmp will show you year and number of seconds since epoch so you can try it. -X option is required to read wtmps style records.

$ /usr/sbin/acct/fwtmp -X < /var/adm/wtmps
system boot 0 2 0000 0000 1115882951 0 May 12 07:29:11 2005
0
...

Re: wtmps access

Pradeep Singh — Mon, 18 Jul 2005 10:24:48 GMT

Thanks everyone for responding.

It seems that /var/adm/wtmp and wtmpx will be obsolete in future releases of HPUX. The new file is /var/adm/wtmps. I can get the last login information using /usr/sbin/acct/fwtmp as suggested by Ermin. Iam curious as to which data structure is used to store entries in this file. I have a small C program which takes out the last entry ( on Solaris and AIX ) and sends it to server for reporting and it would be easy to just use the new data structure.

Re: wtmps access

Ermin Borovac — Mon, 18 Jul 2005 19:17:56 GMT

I believe that getuts(3C) routines are for accessing utmps. If you'd like to read wtmps you can use bwtmps(3C) functions. man 3C bwtmps for more information.

Here is a sample C program that should work.

#include
#include

int main()
{
struct utmps *wtmps;

bwtmpname(WTMPS_FILE);

while ((wtmps = getbwent(sizeof(struct utmps))) != NULL) {
printf("%-8.8s %-12.12s %5ld %2hd %lu %s\n",
wtmps->ut_user,
wtmps->ut_line,
wtmps->ut_pid,
wtmps->ut_type,
wtmps->ut_tv.tv_sec,
wtmps->ut_host
);
}
}

Re: wtmps access

Pradeep Singh — Tue, 19 Jul 2005 10:29:45 GMT

Right on the button Ermin. This is exactly what I wanted. Thanks a Lot.