• utmp檔案記錄當前正在本系統中的使用者的登入資訊
• wtmp檔案記錄登入過本系統的使用者的登入資訊

    PS:man who命令即可查詢到utmp和wtmp檔案在當前系統的位置

• who命令相關：
  1. who顯示當前已登入使用者的使用者資訊
  2. whoami顯示當前shell相關的有效使用者
  3. who am i顯示當前真正已登入使用者的使用者資訊
• utmp和wtmp採用同一結構utmp儲存登入資訊

             #define EMPTY         0 /* Record does not contain valid info
                                        (formerly known as UT_UNKNOWN on Linux) */
             #define RUN_LVL       1 /* Change in system run-level (see
                                        init(8)) */
             #define BOOT_TIME     2 /* Time of system boot (in ut_tv) */
             #define NEW_TIME      3 /* Time after system clock change
                                        (in ut_tv) */
             #define OLD_TIME      4 /* Time before system clock change
                                        (in ut_tv) */
             #define INIT_PROCESS  5 /* Process spawned by init(8) */
             #define LOGIN_PROCESS 6 /* Session leader process for user login */
             #define USER_PROCESS  7 /* Normal process 此處表明此記錄使用者當前是處於登入中*/
             #define DEAD_PROCESS  8 /* Terminated process 此處表明此記錄使用者已經登出 */
             #define ACCOUNTING    9 /* Not implemented */
  
             #define UT_LINESIZE      32
             #define UT_NAMESIZE      32
             #define UT_HOSTSIZE     256
  
             struct exit_status {              /* Type for ut_exit, below */
                 short int e_termination;      /* Process termination status */
                 short int e_exit;             /* Process exit status */
             };
  
             struct utmp {
                 short   ut_type;              /* Type of record */
                 pid_t   ut_pid;               /* PID of login process */
                 char    ut_line[UT_LINESIZE]; /* Device name of tty - "/dev/" */
                 char    ut_id[4];             /* Terminal name suffix,
                                                  or inittab(5) ID */
                 char    ut_user[UT_NAMESIZE]; /* Username */
                 char    ut_host[UT_HOSTSIZE]; /* Hostname for remote login, or
                                                  kernel version for run-level
                                                  messages */
                 struct  exit_status ut_exit;  /* Exit status of a process
                                                  marked as DEAD_PROCESS; not
                                                  used by Linux init (1 */
                 /* The ut_session and ut_tv fields must be the same size when
                    compiled 32- and 64-bit.  This allows data files and shared
                    memory to be shared between 32- and 64-bit applications. */
             #if __WORDSIZE == 64 && defined __WORDSIZE_COMPAT32
                 int32_t ut_session;           /* Session ID (getsid(2)),
                                                  used for windowing */
                 struct {
                     int32_t tv_sec;           /* Seconds 使用者處於登陸中則代表使用者登入時間，使用者已登出則代表使用者登出時間*/
                     int32_t tv_usec;          /* Microseconds */
                 } ut_tv;                      /* Time entry was made */
             #else
                  long   ut_session;           /* Session ID */
                  struct timeval ut_tv;        /* Time entry was made */
             #endif
  
                 int32_t ut_addr_v6[4];        /* Internet address of remote
                                                  host; IPv4 address uses
                                                  just ut_addr_v6[0] */
                 char __unused[20];            /* Reserved for future use */
             };
  
             /* Backward compatibility hacks */
             #define ut_name ut_user
             #ifndef _NO_UT_TIME
             #define ut_time ut_tv.tv_sec
             #endif
             #define ut_xtime ut_tv.tv_sec
             #define ut_addr ut_addr_v6[0]