getutent(3)

💖 getutent(3) — the utmp girlies' guide 💖

okay bestie, gather round, because we're talking about the utmp file access functions from the Standard C library (libc, -lc). it's giving ✨login tracking✨ and honestly? it's a whole vibe. let's go.

---

🌸 NAME 🌸

getutent, getutid, getutline, pututline, setutent, endutent, utmpname — the whole squad that accesses utmp file entries 🦋

---

📚 LIBRARY 📚

Standard C library (libc, -lc) 💅

---

🎀 SYNOPSIS 🎀

#include <utmp.h>

struct utmp *getutent(void);
struct utmp *getutid(const struct utmp *ut);
struct utmp *getutline(const struct utmp *ut);

struct utmp *pututline(const struct utmp *ut);

void setutent(void);
void endutent(void);

int utmpname(const char *path);

no cap, that's the whole roster 💖

---

🫶 DESCRIPTION 🫶

okay first thing, and this is important: new applications should use the POSIX.1-specified "utmpx" versions of these functions — peep the STANDARDS section below for the tea. 👑

utmpname() sets the pathname of the utmp-format file that the other utmp functions go and access. and listen — if you don't use utmpname() to set that pathname before you use the other functions, they're just gonna assume _PATH_UTMP, as defined in <paths.h>. default behaviour, main character energy. 💅

setutent() rewinds the file pointer back to the beginning of the utmp file. generally a good idea to call it before any of the other functions, fr fr — it's like a little reset button for your cursor. 🔄

endutent() closes the utmp file. call it when your user code is done accessing the file with the other functions. clean up after yourself, bestie. 🧹

getutent() reads a line from the current file position in the utmp file. it returns a pointer to a structure containing the fields of the line. the definition of this structure lives in utmp(5) if you wanna go look. 👀

getutid() searches forward from the current file position in the utmp file, based on ut. here's the switcheroo:

• if ut->ut_type is one of RUN_LVL, BOOT_TIME, NEW_TIME, or OLD_TIME, then getutid() finds the first entry whose ut_type field matches ut->ut_type.
• if ut->ut_type is one of INIT_PROCESS, LOGIN_PROCESS, USER_PROCESS, or DEAD_PROCESS, then getutid() finds the first entry whose ut_id field matches ut->ut_id.

getutline() searches forward from the current file position in the utmp file. it scans entries whose ut_type is USER_PROCESS or LOGIN_PROCESS, and returns the first one whose ut_line field matches ut->ut_line. 🎯

pututline() writes the utmp structure ut into the utmp file. it uses getutid() to search for the proper place in the file to insert the new entry. and if it can't find an appropriate slot for ut, pututline() will just append the new entry to the end of the file — no drama, it finds a way. 💖

---

⭐ RETURN VALUE ⭐

getutent(), getutid(), and getutline() return a pointer to a struct utmp on success, and NULL on failure (and yes, that includes the "record not found" case, sadly 😭). heads up though: this struct utmp is allocated in static storage, and it may be overwritten by subsequent calls. so don't go holding onto that pointer like it's your emotional support bestie — it is not. 💀

on success pututline() returns ut; on failure, it returns NULL.

utmpname() returns 0 if the new name was successfully stored, or -1 on failure.

on failure, these functions set errno to indicate the error. ✨

---

😭 ERRORS 😭

• ENOMEM — Out of memory. the vibes are not immaculate, we're all out of brain space.
• ESRCH — Record not found. it's not there bestie, we looked. 🕵️

also: setutent(), pututline(), and the getut*() functions can also fail for the reasons described in open(2). so go read that one too if you're getting weird errors, iykyk.

---

📂 FILES 📂

• /var/run/utmp — database of currently logged-in users 👑 (the "who's online rn" file)
• /var/log/wtmp — database of past user logins 🕰️ (the "who has ever been online" file)

---

🌈 ATTRIBUTES 🌈

for an explanation of the terms used in this section, see attributes(7). the table from the original page, but make it a list because we're cute like that:

• getutent() — Thread safety: MT-Unsafe init race:utent race:utentbuf sig:ALRM timer
• getutid(), getutline() — Thread safety: MT-Unsafe init race:utent sig:ALRM timer
• pututline() — Thread safety: MT-Unsafe race:utent sig:ALRM timer
• setutent(), endutent(), utmpname() — Thread safety: MT-Unsafe race:utent

and in the above table, utent in race:utent means this: if any of the functions setutent(), getutent(), getutid(), getutline(), pututline(), utmpname(), or endutent() are used in parallel in different threads of a program, then data races could occur. bestie. please. do not. 😭

---

📜 STANDARDS 📜

None. that's it. that's the whole section. iconic behaviour honestly. 💅✨

---

🕰️ HISTORY 🕰️

XPG2, SVr4. the ancestors, the originators, the blueprint. 👑

in XPG2 and SVID 2 the function pututline() is documented to return void, and that is genuinely what it does on many systems (AIX, HP-UX). HP-UX introduces a new function _pututline() with the prototype given above for pututline(). so like, heads up if you're porting. 🚨

all these functions are obsolete now on non-Linux systems. POSIX.1-2001 and POSIX.1-2008, following SUSv1, do not have any of these functions — instead they use:

#include <utmpx.h>

struct utmpx *getutxent(void);
struct utmpx *getutxid(const struct utmpx *);
struct utmpx *getutxline(const struct utmpx *);
struct utmpx *pututxline(const struct utmpx *);
void setutxent(void);
void endutxent(void);

these functions are provided by glibc, and they perform the exact same task as their equivalents without the "x" — except they use struct utmpx, which on Linux is defined to be the same as struct utmp. for completeness, glibc also provides utmpxname(), even though this function is not specified by POSIX.1. glibc really said "and one more for the girlies" 💖

on some other systems, the utmpx structure is a superset of the utmp structure, with additional fields, and larger versions of the existing fields, and parallel files are maintained — often /var/*/utmpx and /var/*/wtmpx. fancy. 🌸

Linux glibc on the other hand does not use a parallel utmpx file, since its utmp structure is already large enough. the "x" functions listed above are just aliases for their counterparts without the "x" — for example, getutxent() is an alias for getutent(). 🔥

---

📝 NOTES 📝

🌟 glibc notes 🌟

the above functions are not thread-safe. glibc adds reentrant versions:

#include <utmp.h>

int getutent_r(struct utmp *ubuf, struct utmp **ubufp);
int getutid_r(struct utmp *ut,
              struct utmp *ubuf, struct utmp **ubufp);
int getutline_r(struct utmp *ut,
                struct utmp *ubuf, struct utmp **ubufp);

Feature Test Macro Requirements for glibc (see feature_test_macros(7)):

getutent_r(), getutid_r(), getutline_r():
    _GNU_SOURCE
        || /* Since glibc 2.19: */ _DEFAULT_SOURCE
        || /* glibc <= 2.19: */    _SVID_SOURCE || _BSD_SOURCE

these functions are GNU extensions — the analogs of the functions of the same name without the _r suffix. the ubuf argument gives these functions a place to store their result. on success, they return 0, and a pointer to the result is written in *ubufp. on error, these functions return -1. and there are no utmpx equivalents of the above functions (POSIX.1 does not specify such functions). sad but true. 😭

---

🧪 EXAMPLES 🧪

the following example adds and removes a utmp record, assuming it is run from within a pseudo terminal. for usage in a real application, you should check the return values of getpwuid(3) and ttyname(3). don't be a chaos gremlin, check your returns. 🙈

#include <err.h>
#include <pwd.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>
#include <utmp.h>

int
main(void)
{
    struct utmp entry;

    if (system("echo before adding entry:;who") == -1)
        err(EXIT_FAILURE, "system");

    entry.ut_type = USER_PROCESS;
    entry.ut_pid = getpid();
    strcpy(entry.ut_line, ttyname(STDIN_FILENO) + strlen("/dev/"));
    /* only correct for ptys named /dev/tty[pqr][0-9a-z] */
    strcpy(entry.ut_id, ttyname(STDIN_FILENO) + strlen("/dev/tty"));
    entry.ut_time = time(NULL);
    strcpy(entry.ut_user, getpwuid(getuid())->pw_name);
    memset(entry.ut_host, 0, UT_HOSTSIZE);
    entry.ut_addr = 0;
    setutent();
    if (pututline(&entry) == NULL)
        err(EXIT_FAILURE, "pututline");

    if (system("echo after adding entry:;who") == -1)
        err(EXIT_FAILURE, "system");

    entry.ut_type = DEAD_PROCESS;
    memset(entry.ut_line, 0, UT_LINESIZE);
    entry.ut_time = 0;
    memset(entry.ut_user, 0, UT_NAMESIZE);
    setutent();
    if (pututline(&entry) == NULL)
        err(EXIT_FAILURE, "pututline");

    if (system("echo after removing entry:;who") == -1)
        err(EXIT_FAILURE, "system");

    endutent();
    exit(EXIT_SUCCESS);
}

ate. no notes. 💅✨

---

👀 SEE ALSO 👀

getutmp(3), utmp(5) — go read these next, bestie, they're the sequel 🦋

---

and that's the whole page!! every flag, every field, every caveat, all of it, kept safe and sound 🫶 ngl this one's a classic.

and before you go — this little love letter came to you from Linux man-pages 6.20, dated 2026-02-08, and it's the getutent(3) page, periodt. 💖🎀💜