.\" $Copyright: $
.\" Copyright (c) 1998 by Steve Baker (ice@mama.indstate.edu)
.\" All Rights reserved
.\"
.\" This software is provided as is without any express or implied
.\" warranties, including, without limitation, the implied warranties
.\" of merchant-ability and fitness for a particular purpose.
.\"
...
.V= $Header: writetmp.8 1.0 1998 $
.TH WRITETMP 8 "\*(V)" "UNIX Manual"
.SH NAME
writetmp \- write special wtmp entries to a wtmp file.
.SH SYNOPSIS
\fBwritetmp\fP [\fB-w\fP \fIwtmp\fP|\fB-\fP] [\fB-X[3|4]\fP] [\fB-u\fP \fIuser\fP] [\fB-l\fP \fIline\fP] [\fB-h\fP \fIhost\fP] [\fB-i\fP \fIid\fP] [\fB-p\fP \fIpid\fP] [\fB-t\fP \fItype\fP] [\fB-c\fP \fIcomment\fP] [\fB--help\fP] [\fB--version\fP] [\fBentry-type\fP]
.br
.SH DESCRIPTION
\fIWritetmp\fP is a utility to write special entries to a wtmp file.
Useful as either a replacement for the functionality of the "\fBhalt -w\fP"
or "\fBreboot -w\fP" commands which are normally run at shutdown time or
to write special wtmp entries to an alternate wtmp file to which such entries
would normally not be written.

Under normal conditions radius radtwmp or tacacs accounting logs do not
contain shutdown and boottime entries because the access control software is
not setup to take into account these events.  In the case of a quick
shutdown or server crash, the wtmp file(s) will lose coherency.  To avoid or
minimize the amount of accounting error, it is necessary to write shutdown
and boottime entries to such logs.

Also changes in time which are made manually with \fIdate\fP or via the
network with a program such as \fIrdate\fP are not reflected in the
accounting logs, which, if the time difference is severe can improperly
account time for logins active during the time change.

If an \fIentry-type\fP is specified on the command line, the \fB-u\fP,
\fB-l\fP, \fB-h\fP, \fB-i\fP, \fB-p\fP, \fB-t\fP and \fB-c\fP options are
ignored as writetmp will fill in the username, line, id, and host entries as
required for that particular wtmp entry-type.

\fIWritetmp\fP understands the following entry types:
.TP
\fBshutdown\fP
used just prior to a normal system shutdown.  Also accepts \fBhalt\fP or
\fBreboot\fP as aliases for \fBshutdown\fP.
.PP
.TP
\fBboottime\fP
used at system initialization time, to indicate the system is booting.
.PP
.TP
\fBoldtime\fP
Indicates the time is about to change.
.PP
.TP
\fBnewtime\fP
Indicates the time has changed.  The difference in time is determined from
the timestamp on the last \fBoldtime\fP entry.
.PP
.TP
\fBrunlevel\fP
Indicates a change in runlevel (useless in an accounting sense).
.PP
.SH OPTIONS
\fIWritetmp\fP understands the following command line switches:
.TP
\fB--help\fP
Outputs a verbose usage listing.
.PP
.TP
\fB--version\fP
Displays the version of writetmp.
.PP
.TP
\fB-w\fP \fIwtmp\fP
Select a different output file instead of the default (\fI/var/log/wtmp\fP).
.PP
.TP
\fB-X[3]\fP
Write to a wtmp file maintained by versions 3.3 or 3.4 Tacacs terminal server
access control software.
.PP
.TP
\fB-X4\fP
Write to a wtmp file maintained by version 4.0 of Tacacs terminal server access
control software.
.PP
.TP
\fB-u user\fP
Specify the username for the username field.
.PP
.TP
\fB-l line\fP
Specify the tty name for the line field.
.PP
.TP
\fB-h host\fP
Specify the hostname.
.PP
.TP
\fB-i id\fP
Specify the init id name. Not applicable to tacacs wtmp files.
.PP
.TP
\fB-p pid\fP
Specify the pid number. Not appliccable to tacacs wtmp files.
.PP
.TP
\fB-t type\fP
Specify the type of wtmp entry for the ut_type field, not to be confused
with entry-type.  May be coded as a number or one of:
\fBunknown\fP, \fBrunlevel\fP, \fBboottime\fP, \fBnewtime\fP, \fBoldtime\fP,
\fBinit\fP, \fBlogin\fP, \fBuser\fP or \fBdead\fP.
.PP
.TP
\fB-c comment\fP
Specify the comment for the tacacs 4 wtmp comment field (16 characters max).
.PP
.SH EXAMPLES
Write a shutdown message to an alternate wtmp log:

	writetmp -w /var/adm/xtmp shutdown

A shell script to update the time in an alternate wtmp file when
\fInetdate\fP is run:

	#!/bin/sh
.br
	writetmp -w /var/adm/xtmp oldtime
.br
	netdate clock.llnl.gov
.br
	writetmp -w /var/adm/xtmp newtime

Find out how often and for how long people run a specific program, such as
\fIpine\fP:

	#!/bin/sh
.br
	# /var/adm/cmdtmp must be globally writable.
.br
	cmdtmp=/var/adm/cmdtmp
.br

.br
	writetmp -w $cmdtmp -u pine -l cmd$$ -h $USER -t user
.br
	/path/to/real-pine $*
.br
	writetmp -w $cmdtmp -l cmd$$ -t dead

.SH FILES
/var/log/wtmp        login database.
.SH AUTHOR
Steve Baker (ice@mama.indstate.edu)
.SH BUGS
Does not lock the wtmp file and does not guarantee a successful write.
Could in theory corrupt a log file.

\fIRdate\fP and \fInetdate\fP can take seconds to complete, so writing
oldtime/newtime records around them may not be entirely accurate.
.SH SEE ALSO
.BR date (1),
.BR last (1),
.BR sac (8),
.BR netdate (8L),
.BR reboot (8)