WRITETMP(8)

💖 WRITETMP(8) 💖

okay bestie, welcome to writetmp — straight out of the System Manager's Manual, section 8, the "admin girly" section. she writes special entries into a wtmp file and honestly? she's carrying the whole accounting department on her back. 🫶

---

✨ NAME ✨

writetmp — write special wtmp entries to a wtmp file. no cap, that's the whole job description.

---

🌸 SYNOPSIS 🌸

writetmp [-w wtmp|-] [-X[3|4]] [-u user] [-l line] [-h host] [-i id] [-p
pid] [-t type] [-c comment] [--help] [--version] [entry-type]

---

🦋 DESCRIPTION 🦋

So writetmp is a utility that writes special entries to a wtmp file. She's useful in two main-character situations:

• as a glow-up replacement for what the halt -w or reboot -w commands do — you know, the ones normally run at shutdown time
• or to write those special wtmp entries into an alternate wtmp file, one that would normally never get blessed with such entries

Now here's the tea 🍵. Under normal conditions, radius radtwmp or tacacs accounting logs do not contain shutdown and boottime entries, because the access control software is simply not set up to take those events into account. So if you get a quick shutdown or a server crash? the wtmp file(s) will lose coherency. and that's not the vibe. to avoid or at least minimize the amount of accounting error, it is necessary to write shutdown and boottime entries to such logs.

Also — and this is lowkey important — changes in time made manually with date, or over the network with a program like rdate, are not reflected in the accounting logs. And if the time difference is severe, that can improperly account time for logins that were active during the time change. 😭

Here's the shortcut, bestie: if an entry-type is specified on the command line, then the -u, -l, -h, -i, -p, -t and -c options are ignored, because writetmp will fill in the username, line, id, and host entries as required for that particular wtmp entry-type. she does it herself. she's that girl. 💅

---

👑 entry types she understands 👑

• shutdown — used just prior to a normal system shutdown. also accepts halt or reboot as aliases for shutdown.
• boottime — used at system initialization time, to indicate the system is booting. 🍼
• oldtime — indicates the time is about to change.
• newtime — indicates the time has changed. the difference in time is determined from the timestamp on the last oldtime entry.
• runlevel — indicates a change in runlevel. (useless in an accounting sense. not her fault. 💀)

---

💅 OPTIONS 💅

Writetmp understands the following command line switches:

• --help — outputs a verbose usage listing. she will explain herself, at length, and you will listen. 🎀
• --version — displays the version of writetmp.
• -w wtmp — select a different output file instead of the default (/var/log/wtmp).
• -X[3] — write to a wtmp file maintained by versions 3.3 or 3.4 Tacacs terminal server access control software.
• -X4 — write to a wtmp file maintained by version 4.0 of Tacacs terminal server access control software.
• -u user — specify the username for the username field.
• -l line — specify the tty name for the line field.
• -h host — specify the hostname.
• -i id — specify the init id name. Not applicable to tacacs wtmp files.
• -p pid — specify the pid number. Not applicable to tacacs wtmp files.
• -t type — specify the type of wtmp entry for the ut_type field. ⚠️ do not confuse this with entry-type, they are different things bestie. may be coded as a number or one of: unknown, runlevel, boottime, newtime, oldtime, init, login, user or dead.
• -c comment — specify the comment for the tacacs 4 wtmp comment field (16 characters max).

---

🌈 EXAMPLES 🌈

Write a shutdown message to an alternate wtmp log:

writetmp -w /var/adm/xtmp shutdown

A shell script to update the time in an alternate wtmp file when netdate is run:

#!/bin/sh
writetmp -w /var/adm/xtmp oldtime
netdate clock.llnl.gov
writetmp -w /var/adm/xtmp newtime

Find out how often and for how long people run a specific program, such as pine:

#!/bin/sh
# /var/adm/cmdtmp must be globally writable.
cmdtmp=/var/adm/cmdtmp

writetmp -w $cmdtmp -u pine -l cmd$$ -h $USER -t user
/path/to/real-pine $*
writetmp -w $cmdtmp -l cmd$$ -t dead

---

🍓 FILES 🍓

• /var/log/wtmp — login database.

---

🧚 AUTHOR 🧚

Steve Baker (ice@mama.indstate.edu)

give her author some love fr fr 🫶

---

💀 BUGS 💀

okay so, listen. 🚨

• Does not lock the wtmp file and does not guarantee a successful write. it could, in theory, corrupt a log file. in theory. but still. be aware.
• rdate and netdate can take seconds to complete, so writing oldtime/newtime records around them may not be entirely accurate. 🙈

fr fr, don't come for her about the corruption thing, she told you upfront. that's transparency, that's growth, that's iconic.

---

⭐ SEE ALSO ⭐

date(1), last(1), sac(8), netdate(8L), reboot(8)

---

and that's the whole page bestie, no crumbs left 💜 this one came from the UNIX Manual — that's the source and the version tag living down at the bottom of the original, so consider this your cute little sign-off: go write some wtmp entries, stay coherent, and don't forget to lock your files. ✨ mwah. 🎀