NAME
writetmp - write special wtmp entries to a wtmp file.
SYNOPSIS
writetmp [-w wtmp|-] [-X[3|4]] [-u user] [-l line] [-h host] [-i id]
[-p pid] [-t type] [-c comment] [--help] [--version] [entry-type]
DESCRIPTION
Writetmp is a utility to write special entries to a wtmp file. Useful
as either a replacement for the functionality of the "halt -w" or
"reboot -w" commands which are normally run at shutdown time or to
write special wtmp entries to an alternate wtmp file to which such
entries would normally not be written.
Under normal conditions radius radtwmp or tacacs accounting logs do not
contain shutdown and boottime entries because the access control
software is not setup to take into account these events. In the case
of a quick shutdown or server crash, the wtmp file(s) will lose
coherency. To avoid or minimize the amount of accounting error, it is
necessary to write shutdown and boottime entries to such logs.
Also changes in time which are made manually with date or via the
network with a program such as rdate are not reflected in the
accounting logs, which, if the time difference is severe can improperly
account time for logins active during the time change.
If an entry-type is specified on the command line, the -u, -l, -h, -i,
-p, -t and -c options are ignored as writetmp will fill in the
username, line, id, and host entries as required for that particular
wtmp entry-type.
Writetmp understands the following entry types:
shutdown
used just prior to a normal system shutdown. Also accepts halt
or reboot as aliases for shutdown.
boottime
used at system initialization time, to indicate the system is
booting.
oldtime
Indicates the time is about to change.
newtime
Indicates the time has changed. The difference in time is
determined from the timestamp on the last oldtime entry.
runlevel
Indicates a change in runlevel (useless in an accounting sense).
OPTIONS
Writetmp understands the following command line switches:
--help Outputs a verbose usage listing.
--version
Displays the version of writetmp.
-w wtmp
Select a different output file instead of the default
(/var/log/wtmp).
-X[3] Write to a wtmp file maintained by versions 3.3 or 3.4 Tacacs
terminal server access control software.
-X4 Write to a wtmp file maintained by version 4.0 of Tacacs
terminal server access control software.
-u user
Specify the username for the username field.
-l line
Specify the tty name for the line field.
-h host
Specify the hostname.
-i id Specify the init id name. Not applicable to tacacs wtmp files.
-p pid Specify the pid number. Not appliccable to tacacs wtmp files.
-t type
Specify the type of wtmp entry for the ut_type field, not to be
confused with entry-type. May be coded as a number or one of:
unknown, runlevel, boottime, newtime, oldtime, init, login, user
or dead.
-c comment
Specify the comment for the tacacs 4 wtmp comment field (16
characters max).
EXAMPLES
Write a shutdown message to an alternate wtmp log:
writetmp -w /var/adm/xtmp shutdown
A shell script to update the time in an alternate wtmp file when
netdate is run:
#!/bin/sh
writetmp -w /var/adm/xtmp oldtime
netdate clock.llnl.gov
writetmp -w /var/adm/xtmp newtime
Find out how often and for how long people run a specific program, such
as pine:
#!/bin/sh
# /var/adm/cmdtmp must be globally writable.
cmdtmp=/var/adm/cmdtmp
writetmp -w $cmdtmp -u pine -l cmd$$ -h $USER -t user
/path/to/real-pine $*
writetmp -w $cmdtmp -l cmd$$ -t dead
FILES
/var/log/wtmp login database.
AUTHOR
Steve Baker (ice@mama.indstate.edu)
BUGS
Does not lock the wtmp file and does not guarantee a successful write.
Could in theory corrupt a log file.
Rdate and netdate can take seconds to complete, so writing
oldtime/newtime records around them may not be entirely accurate.
SEE ALSO
date(1), last(1), sac(8), netdate(8L), reboot(8)