Linuxc utmp and wtmp file operations

Linuxc utmp and wtmp file operations

/Var/run/utmp Save the current user information in the system
/Var/log/wtmp Save the user information that has logged on to the system

The information they save is based on the struct utmp (/usr/include/bits/utmp. h)

Utmp struct is defined as follows: struct utmp {short int ut_type; // login type pid_t ut_pid; // pid of the login process char ut_line [UT_LINESIZE]; // login device name, "/dev/" char ut_id [4] is omitted; // Inittab ID char ut_user [UT_NAMESIZE]; // log on to the account char ut_host [UT_HOSTSIZE]; // The Remote Host Name of the Logon account, struxt exit_status ut_exit; // the end state of the process, long int ut_session, when the type is DEAD_PROCESS; // Sessioc ID struct timeval ut_ TV; // time record int32_t ut_addr_v6 [4]; // network address of the remote host char _ unused [20]; // reserved unused}; ut_type has the following types: EMPTY: this is an empty record. RUN_LVL: record the system run-level change BOOT_TIME: record the system boot time NEW_TIME: record the time after the system time change OLD_TINE: record the time when the system time is changed. INIT_PROCESS: records a process derived from init. LOGIN_PROCESS: record the login process. USER_PROCESS: records general processes. DEAD_PROCESS: record the end process. ACCOUNTING: Not used yet. exit_status structure definition: struct exit_status {short int e_termination; // process end status short int e_exit; // process exit status}; struct timeval structure definition: struct timeval {time_t TV _sec; /* seconds */suseconds_t TV _usec;/* microsecond */}; related constant definition: UT_LINESIZE 32UT_NAMESIZE 32UT_HOSTSIZE 256

The functions for reading and modifying these files are as follows:

# Include  Struct utmp * getutent (void); // read a struct tump struct each time from the utmp file. If the file is read or fails, NULL is returned. // additional description: getutent () will open the utmp file during the first call. After reading the data, you can use endutent () to close the utmp file struct utmp * getutid (struct utmp * ut ); // search the records specified by the ut parameter one by one from the Read and Write locations in the utmp file. // 1. If ut-> ut_type is RUN_LVL, BOOT_TIME, NEW_TIME, one of OLD_TIME queries records that match ut-> ut_type; // 2. If ut-> ut_type is INIT_PROCESS, LOGIN_PROCESS, USER_PROCESS, or DEAD_PROCESS, query the records that match ut-> ut_id. struct utmp * getutline (struct utmp * ut); // search ut_t one by one from the read/write location of the utmp File The record where ype is USER_PROCESS or LOGIN_PROCESS, and ut_line is consistent with ut-> ut_line. struct utmp * pututline (struct utmp * ut); // write a struct utmp struct into the file utmp void setutent (void); // open the file utmp, and point the file pointer to the beginning of the file. Void endutent (void); // close the utmpint utmpname (const char * file) file; // set the path of the utmp file. The default path is macro _ PATH_UTMP, this macro is defined in/usr/include/paths. h Medium