---
name: "wtmpdb"
section: "8"
platform: "linux"
package: "wtmpdb"
version: "0.73.0-3+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/wtmpdb"
---

# wtmpdb(8)

display login, logout and reboot information

## NAME

wtmpdb - display login, logout and reboot information

## SYNOPSIS

**wtmpdb** COMMAND \[option...\]

## DESCRIPTION

**wtmpdb** displays the content of the wtmp login and boot times database and provides sub-commands for system scripts to create boot and shutdown entries and otherwise manipulate the wtmp database.

This command is year 2038-safe and uses sqlite3 to store the information.

## COMMANDS

The following commands are understood:

**last** \[*option*...\] \[*username*...\] \[*tty*...\]

**wtmpdb last** goes through the /var/log/wtmp.db database (or the database designated by the **-f** option) and displays a list of of all users logged in and logged out. The output can be restricted to different patterns via various options. If one or more usernames and/or ttys are given **wtmpdb last** will only show the entries matching those arguments.

The login and logout times of the special user **reboot** are the boot and shutdown times of the system.

- **-a, --hostlast**

  Display hostnames in the last column.

- **-d, --dns**

  Translate IP addresses into a hostname.

- **-f, --file** *FILE*

  Use *FILE* as wtmpdb database.

- **-F, --fulltimes**

  Display full times and dates.

- **-i, --ip**

  Translate hostnames to IP addresses.

- **-n, --limit** *N*, **-***N*

  Display only the first *N* entries.

- **-p, --present** *TIME*

  Display who was present at *TIME*.

- **-R, --nohostname**

  Don't display any hostname or IP address.

- **-S, --service**

  Display PAM service used to login.

- **-s, --since** *TIME*

  Print only records more recent than *TIME*.

- **-t, --until** *TIME*

  Print only records until *TIME*.

- **-w, --fullnames**

  Display full IP addresses and user and domain names.

- **-x, --system**

  Display system shutdown entries.

- **--time-format** *FORMAT*

  Display timestamps in the specified *FORMAT*. The format can be *notime*, *short*, *full*, or *iso*. *notime* will not display times at all, *short* is the default option, *full* will display the full times and dates, and *iso* will display times in ISO-8601 format.

*TIME* must be in the format **"YYYYMMDDHHMMSS"**, **"YYYY-MM-DD HH:MM:SS"**, **"YYYY-MM-DD HH:MM"**, **"YYYY-MM-DD"**, **"HH:MM:SS"**, **"HH:MM"**, **"now"**, **"today"**, **"yesterday"** or **"tomorrow"** (time will be set to 00:00:00 if not specified; the date to today's).

**boot** \[*option*...\]

**wtmpdb boot** writes system boot times to the /var/log/wtmp.db database.

- **-f, --file** *FILE*

  Use *FILE* as wtmpdb database.

- **-q, --quiet**

  Don't print informative messages.

**shutdown** \[*option*...\]

**wtmpdb shutdown** writes system shutdown requests to the /var/log/wtmp.db database.

- **-f, --file** *FILE*

  Use *FILE* as wtmpdb database.

**rotate** \[*option*...\]

**wtmpdb rotate** exports old log entries to the /var/log/wtmp\_yyyymmmdd.db database and removes these entries from the original one.

- **-f, --file** *FILE*

  Use *FILE* as wtmpdb database. The exported DB file will be on the same location.

- **-d, --days** *DAYS*

  Entries will be exported which are older than *DAYS* days. Default is 60 days.

**import** \[*option*...\] *file*...

**wtmpdb import** imports legacy wtmp log files to the /var/log/wtmp.db database.

- **-f, --file** *FILE*

  Use *FILE* as wtmpdb database.

global options

- **-h, --help**

  Display help message and exit.

- **-v, --version**

  Print version number and exit.

## FILES

/var/log/wtmp.db

Wtmpdb logging database file

/var/lib/wtmpdb/wtmp.db

Symbolic link from the upstream location to the above database file

## SEE ALSO

[**pam\_wtmpdb**(8)](/pam_wtmpdb/8.md),

## AUTHOR

wtmpdb was written by Thorsten Kukuk \<kukuk@suse.com\>.