utmpdump

Dump wtmp file to stdout

$ utmpdump /var/log/wtmp

$ utmpdump /var/log/btmp

$ utmpdump -f /var/log/wtmp

$ utmpdump -o output.txt /var/log/wtmp

$ utmpdump -r dumpfile > /var/log/wtmp

utmpdump [options] [filename]

utmpdump dumps UTMP and WTMP files in raw format for examination and debugging. It can also reverse the process to write edited login information back to the accounting files.

-f, --follow

Output appended data as the file grows

Write output to specified file instead of stdout

Undump; write edited login information back to utmp/wtmp files

Display help text and exit

Print version and exit

This tool is designed for debugging purposes. The -r option should be used with extreme caution as incorrect usage can corrupt login accounting files. Timestamps use millisecond-precision ISO-8601 format in UTC-0 timezone.

utmpdump is part of the util-linux package, providing utilities for examining and repairing corrupted utmp and wtmp entries.

last(1), who(1), utmp(5), wtmp(5)