UTMPDUMP(1)

💾 utmpdump(1) — the user-commands one, bestie

okay so. you know that random binary blob on your system that's full of login records and you literally cannot read it with your eyeballs? yeah. utmpdump is the little icon that turns it into something you can actually look at. 🎀

---

✨ NAME ✨

utmpdump — dump UTMP and WTMP files in raw format

---

✨ SYNOPSIS ✨

utmpdump [options] filename

---

✨ DESCRIPTION ✨

so utmpdump is like. a simple program, no drama, no extra. its whole thing is dumping UTMP and WTMP files in raw format so you can actually examine them instead of staring at binary soup wondering what went wrong with your life. 😭

and if you don't hand it a filename? it just reads from stdin. lowkey polite of it. no cap.

---

✨ OPTIONS ✨

• -f, --follow — outputs the appended data as the file grows. like tailing it, but make it utmp. 👀
• -o, --output file — writes the command output to file instead of standard output. take it somewhere else, bestie.
• -r, --reverse — undump — writes back edited login information into the utmp or wtmp files. yes this is the scary one. more on that in BUGS. 💀
• -h, --help — displays the help text and exits. the classic.
• -V, --version — displays the version and exits. also the classic.

---

✨ NOTES ✨

real talk: utmpdump is genuinely useful when your utmp or wtmp entries are corrupted. it can dump utmp/wtmp out to an ASCII file, you edit that file to yeet the bogus entries, and then you reintegrate it using:

utmpdump -r < ascii_file > wtmp

⚠️ but be warned bestie — utmpdump was written for debugging purposes only. it's not your everyday main character. it's a backstage pass. 🎟️

🌸 File formats 🌸

only the binary version of the utmp(5) is standardised, fr fr. textual dumps may become incompatible in future. so like. don't build your whole personality on the text format. 😭

the version 2.28 was the last one that printed text output using ctime(3) timestamp format. newer dumps use millisecond precision ISO-8601 timestamp format in UTC-0 timezone. ✨ conversion from the former timestamp format can be made to binary, although an attempt to do so can lead the timestamps to drift by the amount of the timezone offset. so like, it'll work but it's giving slightly wrong o'clock. 🕰️

---

💀 BUGS 💀

you may not use the -r option. periodt. because the format for the utmp/wtmp files strongly depends on the input format. this tool was not written for normal use — it was written for debugging only. it said what it said. 🙈

---

👑 AUTHORS 👑

Michael Krapp

---

🌈 SEE ALSO 🌈

last(1), w(1), who(1), utmp(5)

---

🐛 REPORTING BUGS 🐛

for bug reports, use the issue tracker <https://github.com/util-linux/util-linux/issues>. don't suffer in silence, bestie, that's not the vibe. 🫶

---

📦 AVAILABILITY 📦

the utmpdump command is part of the util-linux package which can be downloaded from the Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>. go get it. slay. 💅

---

and that's the whole page, no notes. this was util-linux 2.42.4, dated 2026-09-21, and it ate. 🎀✨ bye bestie, go dump responsibly 💖