utmp, wtmp, failedlogin File Format

Purpose

Describes formats for user and accounting information.

Description

The utmp file, the wtmp file, and the failedlogin file contain records with user and accounting information.

When a user attempts to logs in, the login program writes entries in two files:

On an invalid login attempt, due to an incorrect login name or password, the login program makes an entry in:

The records in these files follow the utmp format, defined in the utmp.h header file.

Files

Item Description
/etc/utmp Contains a record of users logged into the system.
/var/adm/wtmp Contains connect accounting information.
/etc/security/failedlogin Contains a record of invalid login attempts.