utmp, wtmp, failedlogin File Format

AIX Version 4 Files Reference

Describes formats for user and accounting information.

The utmp file, the wtmp file, and the failedlogin file contain records with user and accounting information.

When a user attempts to logs in, the login program writes entries in two files:

The /etc/utmp file, which contains a record of users logged into the system.
The /var/adm/wtmp file (if it exists), which contains connect-time accounting records.

On an invalid login attempt, due to an incorrect login name or password, the login program makes an entry in:

The /etc/security/failedlogin file, which contains a record of unsuccessful login attempts.

The records in these files follow the utmp format, defined in the utmp.h header file.

This file format is part of Accounting Services in the base operating system Extensions 2.

/etc/utmp	Contains a record of users logged into the system.
/var/adm/wtmp	Contains connect accounting information.
/etc/security/failedlogin	Contains a record of invalid login attempts.

The fwtmp command, init command, login command, su command, who command.

The utmp.h file, lastlog file format.

Accounting Commands in AIX Version 4.3 System Management Guide: Operating System and Devices lists accounting commands that run automatically or keyboard commands entered from the keyboard.

Accounting Overview and Setting Up an Accounting System in AIX Version 4.3 System Management Guide: Operating System and Devices.