'\" t
.\"     Title: wtmpdb
.\"    Author: [see the "AUTHOR" section]
.\" Generator: DocBook XSL Stylesheets v1.79.2 <http://docbook.sf.net/>
.\"      Date: 11/18/2025
.\"    Manual: wtmpdb
.\"    Source: wtmpdb 0.75.0
.\"  Language: English
.\"
.TH "WTMPDB" "8" "11/18/2025" "wtmpdb 0.75.0" "wtmpdb"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
wtmpdb \- display login, logout and reboot information
.SH "SYNOPSIS"
.HP \w'\fBwtmpdb\fR\ 'u
\fBwtmpdb\fR COMMAND [option...]
.SH "DESCRIPTION"
.PP
\fBwtmpdb\fR
displays the content of the wtmp login and boot times database and provides sub\-commands for system scripts to create boot and shutdown entries and otherwise manipulate the wtmp database\&.
.PP
This command is year 2038\-safe and uses sqlite3 to store the information\&.
.SH "COMMANDS"
.PP
The following commands are understood:
.PP
\fBlast\fR [\fIoption\fR\&...] [\fIusername\fR\&...] [\fItty\fR\&...]
.RS 4
\fBwtmpdb last\fR
goes through the
/var/lib/wtmpdb/wtmp\&.db
database (or the database designated by the
\fB\-f\fR
option) and displays a list of of all users logged in and logged out\&. The output can be restricted to different patterns via various options\&. If one or more usernames and/or ttys are given
\fBwtmpdb last\fR
will only show the entries matching those arguments\&.
.sp
The login and logout times of the special user
\fBreboot\fR
are the boot and shutdown times of the system\&.
.PP
\fB\-a, \-\-hostlast\fR
.RS 4
Display hostnames in the last column\&.
.RE
.PP
\fB\-d, \-\-dns\fR
.RS 4
Translate IP addresses into a hostname\&.
.RE
.PP
\fB\-F, \-\-fulltimes\fR
.RS 4
Display full times and dates\&.
.RE
.PP
\fB\-i, \-\-ip\fR
.RS 4
Translate hostnames to IP addresses\&.
.RE
.PP
\fB\-L, \-\-legacy\fR
.RS 4
Display session duration with precision in minutes instead of seconds, which is the default setting for the legacy \*(Aqlast\*(Aq command\&.
.RE
.PP
\fB\-n, \-\-limit\fR \fIN\fR, \fB\-\fR\fIN\fR
.RS 4
Display only the first
\fIN\fR
entries\&.
.RE
.PP
\fB\-o, \-\-open\fR
.RS 4
Display only sessions that are still open, i\&.e\&. no end of session has been recorded since last boot\&.
.RE
.PP
\fB\-p, \-\-present\fR \fITIME\fR
.RS 4
Display who was present at
\fITIME\fR\&.
.RE
.PP
\fB\-R, \-\-nohostname\fR
.RS 4
Don\*(Aqt display any hostname or IP address\&.
.RE
.PP
\fB\-S, \-\-service\fR
.RS 4
Display PAM service used to login\&.
.RE
.PP
\fB\-s, \-\-since\fR \fITIME\fR
.RS 4
Print only records more recent than
\fITIME\fR\&.
.RE
.PP
\fB\-t, \-\-until\fR \fITIME\fR
.RS 4
Print only records until
\fITIME\fR\&.
.RE
.PP
\fB\-u, \-\-unique\fR
.RS 4
Display only the most recent log entry for each user\&. This is the default when called as lastlog or wlastlog\&. In contrast to the legacy lastlog tool, users without any log entries will not be shown\&.
.RE
.PP
\fB\-w, \-\-fullnames\fR
.RS 4
Display full IP addresses and user and domain names\&.
.RE
.PP
\fB\-x, \-\-system\fR
.RS 4
Display system shutdown entries\&.
.RE
.PP
\fB\-\-time\-format\fR \fIFORMAT\fR
.RS 4
Display timestamps in the specified
\fIFORMAT\fR\&. The format can be
\fInotime\fR,
\fIshort\fR,
\fIfull\fR, or
\fIiso\fR\&.
\fInotime\fR
will not display times at all,
\fIshort\fR
is the default option,
\fIfull\fR
will display the full times and dates, and
\fIiso\fR
will display times in ISO\-8601 format\&.
.RE
.sp
\fITIME\fR
must be in the format
\fB"YYYYMMDDHHMMSS"\fR,
\fB"YYYY\-MM\-DD HH:MM:SS"\fR,
\fB"YYYY\-MM\-DD HH:MM"\fR,
\fB"YYYY\-MM\-DD"\fR,
\fB"HH:MM:SS"\fR,
\fB"HH:MM"\fR,
\fB"now"\fR,
\fB"today"\fR,
\fB"yesterday"\fR
or
\fB"tomorrow"\fR
(time will be set to 00:00:00 if not specified; the date to today\*(Aqs)\&.
.RE
.PP
\fBboot\fR [\fIoption\fR\&...]
.RS 4
\fBwtmpdb boot\fR
writes system boot times to the
/var/lib/wtmpdb/wtmp\&.db
database\&.
.PP
\fB\-q, \-\-quiet\fR
.RS 4
Don\*(Aqt print informative messages\&.
.RE
.RE
.PP
\fBboottime\fR [\fIoption\fR\&...]
.RS 4
\fBwtmpdb boottime\fR
shows the time of the last boot\&.
.RE
.PP
\fBshutdown\fR [\fIoption\fR\&...]
.RS 4
\fBwtmpdb shutdown\fR
writes system shutdown requests to the
/var/lib/wtmpdb/wtmp\&.db
database\&.
.RE
.PP
\fBrotate\fR [\fIoption\fR\&...]
.RS 4
\fBwtmpdb rotate\fR
exports old log entries to the
/var/lib/wtmpdb/wtmp_yyyymmmdd\&.db
database and removes these entries from the original one\&.
.PP
\fB\-d, \-\-days\fR \fIDAYS\fR
.RS 4
Entries will be exported which are older than
\fIDAYS\fR
days\&. Default is 60 days\&.
.RE
.RE
.PP
\fBimport\fR [\fIoption\fR\&...] \fIfile\fR\&...
.RS 4
\fBwtmpdb import\fR
imports legacy wtmp log files to the
/var/lib/wtmpdb/wtmp\&.db
database\&.
.RE
.PP
common options
.RS 4
.PP
\fB\-f, \-\-file\fR \fIFILE\fR
.RS 4
Use
\fIFILE\fR
as wtmpdb database\&.
.RE
.PP
\fB\-h, \-\-help\fR
.RS 4
Display help message and exit\&.
.RE
.PP
\fB\-v, \-\-version\fR
.RS 4
Print version number and exit\&.
.RE
.RE
.SH "FILES"
.PP
/var/lib/wtmpdb/wtmp\&.db
.RS 4
Wtmpdb logging database file
.RE
.SH "SEE ALSO"
.PP
\fBpam_wtmpdb\fR(8),
.SH "AUTHOR"
.PP
wtmpdb was written by Thorsten Kukuk <kukuk@suse\&.com>\&.