Linux 中 utmp 结构定义如下：

// /usr/include/x86_64-linux-gnu/bits/utmp.h
/* The structure describing an entry in the user accounting database.  */
struct utmp
{
  short int ut_type;		/* 登录类型 */
  pid_t ut_pid;			/*  login 进程的 pid  */
  char ut_line[UT_LINESIZE]     /* 终端名 */
    __attribute_nonstring__;	/* Devicename.  */
  char ut_id[4];		/* Inittab ID.  */
  char ut_user[UT_NAMESIZE]    /* 登录账号 */
    __attribute_nonstring__;	/* Username.  */
  char ut_host[UT_HOSTSIZE]    /* 登录账号的主机名称 */
    __attribute_nonstring__;	/* Hostname for remote login.  */
  struct exit_status ut_exit;	/* Exit status of a process marked
				   as DEAD_PROCESS.  
                                    当类型为 DEAD_PROCESS 时进程的结束状态*/
/* The ut_session and ut_tv fields must be the same size when compiled
   32- and 64-bit.  This allows data files and shared memory to be
   shared between 32- and 64-bit applications.  */
#if __WORDSIZE_TIME64_COMPAT32
  int32_t ut_session;		/* Session ID, used for windowing.  */
  struct
  {
    int32_t tv_sec;		/* Seconds.  */
    int32_t tv_usec;		/* Microseconds.  */
  } ut_tv;			/* 时间记录 Time entry was made.  */
#else
  long int ut_session;		/* Session ID, used for windowing.  */
  struct timeval ut_tv;		/* Time entry was made.  */
#endif

  int32_t ut_addr_v6[4];	/* 远程主机的网络地址 Internet address of remote host.  */
  char __glibc_reserved[20];		/* 保留未使用 Reserved for future use.  */
};

/* The structure describing the status of a terminated process.  This
   type is used in `struct utmp' below.  */
struct exit_status
  {
    short int e_termination;	/* 进程结束状态 Process termination status.  */
    short int e_exit;		/* 进程退出状态 Process exit status.  */
  };

 

/* Values for the `ut_type' field of a `struct utmp'.  */
#define EMPTY		0	/* No valid user accounting information.  */

#define RUN_LVL		1	/* 系统的运行级别 The system's runlevel.  */
#define BOOT_TIME	2	/* 系统启动时间 Time of system boot.  */
#define NEW_TIME	3	/* 系统时钟改变后的时间 Time after system clock changed.  */
#define OLD_TIME	4	/* 系统时钟改变的时间 Time when system clock changed.  */

#define INIT_PROCESS	5	/*由init进程生成的进程 Process spawned by the init process. */
#define LOGIN_PROCESS	6	/* Session leader of a logged in user.  */
#define USER_PROCESS	7	/* Normal process.  */
#define DEAD_PROCESS	8	/* 终止进程 Terminated process.  */

#define ACCOUNTING	9