01Location
- /var/log/wtmp
- /var/log/btmp
- /var/log/lastlog
- /var/run/utmp (current sessions)
- /var/lib/wtmpdb/wtmp.db (wtmpdb, where used)
- /var/lib/lastlog/lastlog2.db (lastlog2, where used)
02Questions it answers
- Who logged in, on which terminal, from which host, and when did they log out?
- When was the system booted, rebooted or shut down?
- Were there failed login attempts and from where?
- When did each account last log in?
03Format and versions
| Format | wtmp/btmp/utmp: fixed-size struct utmp records (384 bytes for 32-bit builds or 64-bit builds with 32-bit compatibility, 400 bytes otherwise). lastlog: sparse file of struct lastlog entries positioned by UID. wtmpdb and lastlog2 use SQLite. |
|---|---|
| Applies to | glibc utmp/lastlog layouts; on bi-arch systems such as x86-64 the time fields stay 32-bit. wtmpdb and lastlog2 are Y2038-safe replacements adopted by some distributions. |
04Key fields
| Field | What it tells you |
|---|---|
| ut_type | Record type: 1 RUN_LVL, 2 BOOT_TIME, 3 NEW_TIME, 4 OLD_TIME, 5 INIT_PROCESS, 6 LOGIN_PROCESS, 7 USER_PROCESS, 8 DEAD_PROCESS. |
| ut_pid, ut_line, ut_id | Process ID, terminal device name and terminal suffix or inittab ID. |
| ut_user | User name; in wtmp an empty name marks a logout on that terminal. |
| ut_host, ut_addr_v6 | Remote host name (or kernel version for run-level records) and remote address. |
| '~' line with user 'shutdown' or 'reboot' | System shutdown or reboot marker in wtmp; '|' and '}' lines record old and new time when the clock is changed. |
| lastlog: ll_time, ll_line, ll_host | Last login time, terminal and host for the UID at that position. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| ut_tv (tv_sec, tv_usec) | Unix seconds + microseconds, int32 each on bi-arch builds | libyal documents the values as POSIX time in UTC. |
| ll_time | Unix seconds, 32-bit when 32-bit compatibility is enabled | Overflows in 2038 on such builds; lastlog2 was introduced as a Y2038-safe alternative. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy wtmp, btmp, lastlog and rotated copies (wtmp.1 and similar), plus any wtmpdb/lastlog2 databases.
- Parse the copies with a structure-aware parser or with last -f / lastb -f, using full time output.
- Pair USER_PROCESS records with the following DEAD_PROCESS or empty-user record on the same ut_line to build sessions.
- Compare session times with authentication logs and the journal.
07Interpretation pitfalls
- The files are written only if they exist; if removed, record keeping silently stops.
- Records are fixed-size and unauthenticated; zeroed or removed records leave no internal trace beyond gaps.
- lastlog is a sparse file whose apparent size grows with the highest UID; its large size is normal.
- Record size and time width depend on the architecture and build; parse with the layout of the source system.
09Sources
- utmp(5) — Linux manual page man7.org · checked 2026-10-14
- last(1) / lastb — util-linux documentation util-linux (GitHub) · checked 2026-10-14
- lastlog2(8) — util-linux documentation util-linux (GitHub) · checked 2026-10-14
- lastlog(8) — shadow-utils manual source shadow-maint (GitHub) · checked 2026-10-14
- glibc bits/utmp.h (struct lastlog) GNU C Library (GitHub mirror) · checked 2026-10-14
- libyal dtformats — Utmp login records format Joachim Metz (GitHub) · checked 2026-10-14
- wtmpdb — Y2038 safe version of wtmp Thorsten Kukuk (GitHub) · checked 2026-10-14