utmp, wtmp, failedlogin File Format

Purpose

Describes formats for user and accounting information.

The utmp file, the wtmp file, and the failedlogin file contain records with user and accounting information.

When a user attempts to logs in, the login program writes entries in two files:

The /etc/utmp file, which contains a record of users logged into the system.
The /var/adm/wtmp file (if it exists), which contains connect-time accounting records.

On an invalid login attempt, due to an incorrect login name or password, the login program makes an entry in:

The /etc/security/failedlogin file, which contains a record of unsuccessful login attempts.

The records in these files follow the utmp format, defined in the utmp.h header file.

Item	Description
/etc/utmp	Contains a record of users logged into the system.
/var/adm/wtmp	Contains connect accounting information.
/etc/security/failedlogin	Contains a record of invalid login attempts.