From the earlier question:

why are utmp, wtmp and btmp called as they are?

I would like to now what the 'tmp' part is. Is it 'temp/temporary'. As you can see from the earlier question, that part wasn't answered.


tmp may be short for temporary (as in transient) since these files are, like log files, periodically rotated/truncated. The utmp and wtmp files also initially resided in /tmp when they were introduced in Version 3 AT&T Unix.

However, tmp could nowadays be read as an abbreviation of timestamp. tm is also a common abbreviation of time (see, e.g., the manual for the ctime() C function and the time.h header) and these files contain the timestamps for system events relating to users logging in.

  • The u in utmp likely comes from user.
  • The b in btmp (on systems that has it) likely comes from bad (bad logins).
  • The w in wtmp may come from who (as in "who was logged in?"), but not from who or w (the utilities) as they use utmp and not wtmp.
  • I suspect this is incorrect. If you look at the actual C implementation of the utmp stuff, you'll see a lot of the struct members contain ut_..., indicating that the ut is the prefix, and separate from the mp part. man7.org/linux/man-pages/man5/utmp.5.html – Patrick May 30 '17 at 12:40
  • 1
    @Patrick I know. The other explanation for the ut_ struct members is that ut is the first two characters of utmp, and nothing more than that. – Kusalananda May 30 '17 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.