.\" Copyright (C) 2010 Michael Krapp
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
.\"
.TH UTMPDUMP 1 "July 2014" "util-linux" "User Commands"
.SH NAME
utmpdump \- dump UTMP and WTMP files in raw format
.SH SYNOPSIS
.BR utmpdump " [options]"
.RI [ filename ]
.SH DESCRIPTION
.B utmpdump
is a simple program to dump UTMP and WTMP files in raw format, so they
can be examined.
.B utmpdump
reads from stdin unless a
.I filename
is passed.
.SH OPTIONS
.TP
.BR \-f , " \-\-follow"
Output appended data as the file grows.
.TP
.BR \-o , " \-\-output " \fIfile
Write command output to \fIfile\fR instead of standard output.
.TP
.BR \-r , " \-\-reverse"
Undump, write back edited login information into the utmp or wtmp files.
.TP
.BR \-V , " \-\-version"
Display version information and exit.
.TP
.BR \-h , " \-\-help"
Display help text and exit.
.SH NOTES
.B utmpdump
can be useful in cases of corrupted utmp or wtmp entries. It can dump
out utmp/wtmp to an ASCII file, which can then be edited to remove
bogus entries, and reintegrated using:
.PP
.RS
.B utmpdump -r < ascii_file > wtmp
.RE
.PP
But be warned,
.B utmpdump
was written for debugging purposes only.
.SS File formats
.PP
Only the binary version of the
.BR utmp (5)
is standardised. Textual dumps may become incompatible in future.
.PP
The version 2.28 was the last one that printed text output using
.BR ctime (3)
timestamp format. Newer dumps use millisecond precision ISO-8601 timestamp
format in UTC-0 timezone. Conversion from former timestamp format can be
made to binary, although attempt to do so can lead the timestamps to drift
amount of timezone offset.
.SH BUGS
You may
.B not
use the
.B \-r
option, as the format for the utmp/wtmp files strongly depends on the input
format. This tool was
.B not
written for normal use, but for debugging only.
.SH AUTHOR
Michael Krapp
.SH "SEE ALSO"
.BR last (1),
.BR w (1),
.BR who (1),
.BR utmp (5)
.SH AVAILABILITY
The utmpdump command is part of the util-linux package and is available
from
.UR https://\:www.kernel.org\:/pub\:/linux\:/utils\:/util-linux/
Linux Kernel Archive
.UE .
