1

Linux system normally stores current user login information in /var/run/utmp, and stores historical information in /var/log/wtmp.

So, how does it synchronize information between them,

  1. When a login happens, does it write to both of these files or does it merge them later?
  2. /var/run/utmp is not supposed to be persistent, and it will be a lost at system shutdown or reboot?
Improve this question
1
  • I think utmp is actually created/replaced by init at boot. man utmp has some clues about this. Commented Nov 17, 2013 at 11:29

1 Answer 1

Reset to default
7

In libmisc/utmp.c (for Debian in the source of the login package) line 301 the comment for setutmp() reads:

/* * setutmp - Update an entry in utmp and log an entry in wtmp * * Return 1 on failure and 0 on success. */

Actually /var/run/utmp is updated first immediately followed by writing the log by calling updwtmp() (if PAM if used, PAM writes the log). In both cases both the information is written explicitly and not synced, so your point 2 is not relevant.

To find this on a Debian system. First guess who could do the writing (kernel, login command). Search utmp and wtmp strings in kernel doesn't give much info. So use dpkg -S $(which login) to find the package name where login comes from and google for debian login package. That will lead you to shadow*.tar.gz in those sources you will find the code that writes utmp and wtmp.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.