utmp/utmpx/utmps vs wtmp/wtmps

[SeaMark_1]

I am using HP-UX 11iv2.

Have read many manpages, I can't understand the relation between them.

I have some question:
1) Daemon utmpd write in-memory records into utmp or utmpx?? When I execute:

/sbin/init.d/utmpd stop
/sbin/init.d/utmpd start

I found the mtime of utmp don't be updated ~~~ however utmpx is updated, utmps contend increased.

root@xkbqd06# ll ut*
-rw-r--r-- 1 root root 1140 Jan 6 21:59 utmp
-rw-r--r-- 1 root root 16200 Jan 7 10:47 utmps
-rw-r--r-- 1 root root 3780 Jan 8 11:33 utmpx
root@xkbqd06# /sbin/init.d/utmpd stop
utmp daemon stopped
root@xkbqd06# ll ut*
-rw-r--r-- 1 root root 1140 Jan 6 21:59 utmp
-rw-r--r-- 1 root root 14904 Jan 8 12:05 utmps
-rw-r--r-- 1 root root 3780 Jan 8 12:05 utmpx

Manpage tell me the use of utmps would be discontinued in future releases.

Is it a historical problem?

2) In HP-UX accounting, connect time accounting is handled by utmpd ??

3) Who write wtmp/wtmps files, just as btmp/btmps ? OS kernel or utmpd ?

I can't find useful info in manpages.

Any help is appreciated . :-)

All the best.

[SeaMark_1]

I feel wtmp is related utmp indeed, since one command -- utmp2wtmp -- exists, don't it?

[lawrenzo]

Hello,

as the man page states these files hold user and account information.

As far as I am aware each action ie incorrect login will write various info into the utmp, btmp and wtmp files.

The info in these files for example will be used when running something like the write command.

not sure of the question so hth

[SeaMark_1]

After more attemps, I try to answer self'questiones.

1)utmpx is used to replace utmp.
utmp and utmpx is updated simultaneously.

utmpd is used to replace utmp/utmpx. when utmpd is not running, in-memory utmpd records are writed into utmps.So, when I stop/start /sbin/init.d/utmpd, the synchronizationthe between utmps and utmpx occurs and their mtime is changed.

2)In HP-UX accounting, connect time accounting is handled by utmpd/login/init(other are unknown now).
and Process accounting is performed by the HP-UX system kernel.

3)utmp/utmpx/wtmp/wtmps/btmp/btmps are maintained by login&init.
See this, I runing at level 2.

root@xkbqd01# ll /etc/ut* /var/adm/wt*
-rw-r--r-- 1 root root 840 Jan 6 11:14 /etc/utmp
-rw-r--r-- 1 root root 11664 Jan 10 15:56 /etc/utmps
-rw-r--r-- 1 root root 2660 Jan 10 15:56 /etc/utmpx
-rw-rw-r-- 1 adm adm 123600 Dec 30 11:34 /var/adm/wtmp
-rw-rw-r-- 1 adm adm 4564 Jan 10 14:54 /var/adm/wtmps
root@xkbqd01# init 3
root@xkbqd01# ll /etc/ut* /var/adm/wt*
-rw-r--r-- 1 root root 840 Jan 10 16:10 /etc/utmp
-rw-r--r-- 1 root root 11664 Jan 10 15:56 /etc/utmps
-rw-r--r-- 1 root root 2660 Jan 10 16:10 /etc/utmpx
-rw-rw-r-- 1 adm adm 123840 Jan 10 16:10 /var/adm/wtmp
-rw-rw-r-- 1 adm adm 7172 Jan 10 16:10 /var/adm/wtmps

utmps is not updated because utmpd is running.

Some advice? Welcome to discuss.:-)

[Gerry Xie_1]

Dear SeeMark,

Your study/research is so much make sense.
Leart a lot from you. Thanks.

By the way, I have some questions for you --
(1) my wtmps is getting too large, how do I truncate some ? (I don't want delete them all)

(2) how can I just delete a few rows in wtmps -- where the record I don't want to be left there?

(3) If I rename the wtmps, which program suppose to recreate a new wtmps or there is none such a thing. Which one is adding new records to wtmps and can I temporarily stop the adding process?

thank you again.

[SeaMark_1]

Thanks.

i suggest you read manpage of command "fwtmp", which can transfer wtmp-like file to ASCII form.
That would help you understand the content of files you mentioned.

Just advice. :)