100 lines
2.7 KiB
Groff
100 lines
2.7 KiB
Groff
'\" t
|
|
.\" Title: utmpdump
|
|
.\" Author: [see the "AUTHOR(S)" section]
|
|
.\" Generator: Asciidoctor 2.0.15
|
|
.\" Date: 2022-02-17
|
|
.\" Manual: User Commands
|
|
.\" Source: util-linux 2.38
|
|
.\" Language: English
|
|
.\"
|
|
.TH "UTMPDUMP" "1" "2022-02-17" "util\-linux 2.38" "User Commands"
|
|
.ie \n(.g .ds Aq \(aq
|
|
.el .ds Aq '
|
|
.ss \n[.ss] 0
|
|
.nh
|
|
.ad l
|
|
.de URL
|
|
\fI\\$2\fP <\\$1>\\$3
|
|
..
|
|
.als MTO URL
|
|
.if \n[.g] \{\
|
|
. mso www.tmac
|
|
. am URL
|
|
. ad l
|
|
. .
|
|
. am MTO
|
|
. ad l
|
|
. .
|
|
. LINKSTYLE blue R < >
|
|
.\}
|
|
.SH "NAME"
|
|
utmpdump \- dump UTMP and WTMP files in raw format
|
|
.SH "SYNOPSIS"
|
|
.sp
|
|
\fButmpdump\fP [options] \fIfilename\fP
|
|
.SH "DESCRIPTION"
|
|
.sp
|
|
\fButmpdump\fP is a simple program to dump UTMP and WTMP files in raw format, so they can be examined. \fButmpdump\fP reads from stdin unless a \fIfilename\fP is passed.
|
|
.SH "OPTIONS"
|
|
.sp
|
|
\fB\-f\fP, \fB\-\-follow\fP
|
|
.RS 4
|
|
Output appended data as the file grows.
|
|
.RE
|
|
.sp
|
|
\fB\-o\fP, \fB\-\-output\fP \fIfile\fP
|
|
.RS 4
|
|
Write command output to \fIfile\fP instead of standard output.
|
|
.RE
|
|
.sp
|
|
\fB\-r\fP, \fB\-\-reverse\fP
|
|
.RS 4
|
|
Undump, write back edited login information into the utmp or wtmp files.
|
|
.RE
|
|
.sp
|
|
\fB\-h\fP, \fB\-\-help\fP
|
|
.RS 4
|
|
Display help text and exit.
|
|
.RE
|
|
.sp
|
|
\fB\-V\fP, \fB\-\-version\fP
|
|
.RS 4
|
|
Print version and exit.
|
|
.RE
|
|
.SH "NOTES"
|
|
.sp
|
|
\fButmpdump\fP can be useful in cases of corrupted utmp or wtmp entries. It can dump out utmp/wtmp to an ASCII file, which can then be edited to remove bogus entries, and reintegrated using:
|
|
.RS 3
|
|
.ll -.6i
|
|
.sp
|
|
\fButmpdump \-r < ascii_file > wtmp\fP
|
|
.br
|
|
.RE
|
|
.ll
|
|
.sp
|
|
But be warned, \fButmpdump\fP was written for debugging purposes only.
|
|
.SS "File formats"
|
|
.sp
|
|
Only the binary version of the \fButmp\fP(5) is standardised. Textual dumps may become incompatible in future.
|
|
.sp
|
|
The version 2.28 was the last one that printed text output using \fBctime\fP(3) timestamp format. Newer dumps use millisecond precision ISO\-8601 timestamp format in UTC\-0 timezone. Conversion from former timestamp format can be made to binary, although attempt to do so can lead the timestamps to drift amount of timezone offset.
|
|
.SH "BUGS"
|
|
.sp
|
|
You may \fBnot\fP use the \fB\-r\fP option, as the format for the utmp/wtmp files strongly depends on the input format. This tool was \fBnot\fP written for normal use, but for debugging only.
|
|
.SH "AUTHORS"
|
|
.sp
|
|
Michael Krapp
|
|
.SH "SEE ALSO"
|
|
.sp
|
|
\fBlast\fP(1),
|
|
\fBw\fP(1),
|
|
\fBwho\fP(1),
|
|
\fButmp\fP(5)
|
|
.SH "REPORTING BUGS"
|
|
.sp
|
|
For bug reports, use the issue tracker at \c
|
|
.URL "https://github.com/util\-linux/util\-linux/issues" "" "."
|
|
.SH "AVAILABILITY"
|
|
.sp
|
|
The \fButmpdump\fP command is part of the util\-linux package which can be downloaded from \c
|
|
.URL "https://www.kernel.org/pub/linux/utils/util\-linux/" "Linux Kernel Archive" "." |