RAWTMP(1)

💖 RAWTMP(1) — the rawtmp page, bestie edition 💖

okay so this is a page from the General Commands Manual, and the star of the show is a lil utility called rawtmp. she's niche. she's iconic. let's get into it 🫶

---

✨ NAME ✨

rawtmp — display wtmp entries in raw form.

like. literally just shows you the raw vibes. no filter, no glow-up, just data 💅

---

🌸 SYNOPSIS 🌸

rawtmp [-da] [-w wtmp|-] [-X[3|4]d] [-s start] [-e end] [-b H:M:S]
[--help] [--version]

yes bestie, that's the whole shape of her. every bracket is a choice you get to make. main character energy fr fr ✨

---

🦋 DESCRIPTION 🦋

so rawtmp is a utility that dumps the raw data sitting inside a wtmp or utmp file straight to your screen so you can look at it. that's it. that's the job. and honestly? she ate. 💅

who's this for? anyone who wants to divine the nature of the data stored in the wtmp or utmp files — like, peer into the mystery, bestie 🔮. it's also handy if you need to extract special wtmp entries that are not documented anywhere. yes, those exist. yes, they're feral. (we're looking at you, the entries that netdate puts in the wtmp file 👀).

now here's a detail that's lowkey fascinating 🧚 — on a logout, sometimes the username is encoded in the ut_user field by replacing the first character of the username with a null. when that happens, rawtmp will print the contents of the user field with a leading dot . to denote the null character. cute, right? only agetty and tacacs control software are currently known to use this logging method. no cap.

---

💅 OPTIONS 💅

rawtmp understands the following command line switches. every single one, we're listing them all, no skipping, periodt:

• --help — outputs a verbose usage listing. she will talk to you. at length. 💬
• --version — displays the version of rawtmp. know your queen's number, bestie 👑
• -w wtmp — select a different input file instead of the default (/var/log/wtmp). your file, your rules 🎀
• -X[3] — read a wtmp file maintained by versions 3.3 or 3.4 Tacacs terminal server access control software.
• -X4 — read a wtmp file maintained by version 4.0 of Tacacs terminal server access control software. different era, different file format, iykyk 🕰️
• -d — output the time in MMM DD HH:MM:SS format instead of raw time, for a more human readable form (and to actually know what day you're looking at!). ngl this one is a lifesaver because raw timestamps are giving cryptic 😭
• -a — print the contents of the ut_addr field (in quad-dotted notation) instead of using the ut_host field.

⚠️ heads up bestie: ut_addr is almost never used and more than likely contains garbage information. like, she's not even trying. don't trust her.

• -b hours[:minutes[:seconds]] — consider only those utmp entries that fall within the last few hours/minutes/seconds from the current time, disregarding the rest. a little time-travel filter, but only backwards, and only a lil bit 🕐
• -s start — selects the starting date of the report, in mm/dd/yy format. 📅
• -e end — selects the ending date of the report, in mm/dd/yy format. 📅✨

---

🍓 FILES 🍓

• /var/log/wtmp — login database.

that's the default girlie, the one rawtmp reaches for unless you tell her otherwise with -w. 💜

---

👑 AUTHOR 👑

Steve Baker (ice@mama.indstate.edu)

we stan. thank you for your service 🫡💖

---

💀 BUGS 💀

Could use some filtering options.

that's it. that's the whole bug report. she's honest. she's concise. she's kind of iconic for it honestly 😭

---

🌈 SEE ALSO 🌈

last(1), sac(8)

go read those too bestie, they're the extended universe 📚✨

---

and that's the whole page, no notes, every single detail preserved, nothing skipped, we ate and left no crumbs 🎀

signing off from the UNIX Manual, page RAWTMP(1), version vibes intact — mwah 💋✨