utmp文件

/var/run/utmp文件保存着当前登录到系统中的用户信息，通过解析此文件可以获取登录用户的一些信息。这些信息是基于结构体 struct utmp保存起来的。在系统中对应的结构定义，一般在/usr/include/bits/utmp.h。有些平台的路径中可能含有CPU架构信息。如，我的ARM平台utmp.h在/usr/include/aarch64-linux-gnu/bits/utmp.h。感兴趣的同学可以使用find命令查找下自己的环境utmp.h在什么地方保存。使用vi打开就可以看到struct utmp完整的定义了。
utmp.h精简后重要数据结构定义，如下

struct utmp结构
struct utmp
{
  short int ut_type;            /* Type of login.  */
  pid_t ut_pid;                 /* Process ID of login process.  */
  char ut_line[UT_LINESIZE];    /* Devicename.  */
  char ut_id[4];                /* Inittab ID.  */
  char ut_user[UT_NAMESIZE];    /* Username.  */
  char ut_host[UT_HOSTSIZE];    /* Hostname for remote login.  */
  struct exit_status ut_exit;   /* Exit status of a process marked as DEAD_PROCESS.  */
  long int ut_session;          /* Session ID, used for windowing.  */
  struct timeval ut_tv;         /* Time entry was made.  */
  int32_t ut_addr_v6[4];        /* Internet address of remote host.  */
  char __unused[20];            /* Reserved for future use.  */
};

ut_type的类型
#define EMPTY           0       /* No valid user accounting information.  */
#define RUN_LVL         1       /* The system's runlevel.  */
#define BOOT_TIME       2       /* Time of system boot.  */
#define NEW_TIME        3       /* Time after system clock changed.  */
#define OLD_TIME        4       /* Time when system clock changed.  */
#define INIT_PROCESS    5       /* Process spawned by the init process.  */
#define LOGIN_PROCESS   6       /* Session leader of a logged in user.  */
#define USER_PROCESS    7       /* Normal process.  */
#define DEAD_PROCESS    8       /* Terminated process.  */
#define ACCOUNTING      9

exit_status结构
struct exit_status
{
    short int e_termination;    /* Process termination status.  */
    short int e_exit;           /* Process exit status.  */
};

相关宏定义
#define UT_LINESIZE     32
#define UT_NAMESIZE     32
#define UT_HOSTSIZE     256