From the earlier question:

why are utmp, wtmp and btmp called as they are?

I would like to now what the 'tmp' part is. Is it 'temp/temporary'. As you can see from the earlier question, that part wasn't answered.

1 Answer 1


tmp may be short for temporary (as in transient) since these files are, like log files, periodically rotated/truncated. The utmp and wtmp files also initially resided in /tmp when they were introduced in Version 3 AT&T Unix.

However, tmp could nowadays be read as an abbreviation of timestamp. tm is also a common abbreviation of time (see, e.g., the manual for the ctime() C function and the time.h header) and these files contain the timestamps for system events relating to users logging in.

  • The u in utmp likely comes from user.
  • The b in btmp (on systems that has it) likely comes from bad (bad logins).
  • The w in wtmp may come from who (as in "who was logged in?"), but not from who or w (the utilities) as they use utmp and not wtmp.
  • 1
    I suspect this is incorrect. If you look at the actual C implementation of the utmp stuff, you'll see a lot of the struct members contain ut_..., indicating that the ut is the prefix, and separate from the mp part. man7.org/linux/man-pages/man5/utmp.5.html
    – phemmer
    May 30, 2017 at 12:40
  • 1
    @Patrick I know. The other explanation for the ut_ struct members is that ut is the first two characters of utmp, and nothing more than that.
    – Kusalananda
    May 30, 2017 at 12:45
  • 1
    To pick a nit: utmp existed in V1 already. See a.papnet.eu/UNIX/v1man/man5/utmp, datestamped November 1971. It did reside in /tmp, though later man pages locate it in /etc. Feb 2, 2020 at 1:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .