Unix system log files include:

  • utmp
  • wtmp
  • lastlog

Unix records information about current users in the file utmp, logins and logouts in the file wtmp, and last logins in the file lastlog. The time stamps of date changes, shutdowns and reboots are also logged in the wtmp file.

The usual locations of these files are:

Log file Usual location
utmp /etc/utmp
wtmp /usr/adm/wtmp
lastlog /usr/adm/lastlog

Editing Unix System Log Files

These log files are not text files that can be edited by hand with vi; these are binary files which should be edited with programs specifically written for this purpose.