Wtmp / Utmp / Btmp
Definition
Binary login databases under /var/log and /var/run. wtmp logs successful logins, utmp reflects current sessions, btmp logs failed login attempts. Read with last, w, lastb.
- wtmp records
- Successful logins and logouts, historical
- utmp records
- Currently active login sessions
- btmp records
- Failed login attempts
- Typical path
- /var/log/wtmp, /var/run/utmp, /var/log/btmp
- Read with
- last, w, lastb commands
Common questions
Can wtmp be trusted if an attacker had root access?+
No. Root can rewrite or truncate wtmp, utmp and btmp directly, so these logs should be corroborated with independent sources such as auth.log, shell history and file timestamps before being relied on as sole proof of a login event.
What is the difference between utmp and wtmp in an investigation?+
utmp only shows sessions active at the moment it is read, so it is nearly useless after the fact; wtmp accumulates a rolling history of login and logout events over time, making it the file investigators normally parse for a timeline.
Why does btmp matter in an intrusion case?+
btmp records failed login attempts, so a spike of entries against one account, or attempts against many usernames from one source, often marks brute-force password guessing that preceded a successful compromise found later in wtmp.
Related terms
- Auditd
- The Linux Audit Daemon. Writes /var/log/audit/audit.log based on rules configured in /etc/audit/audit.rules. Read with ausearch and aureport.
- Inode
- The ext2/3/4 metadata structure that holds a file's permissions, ownership, MAC times, link count and block pointers. The file name lives in...
- Journalctl
- The query interface to systemd-journald, the binary structured-logging daemon that backs modern Linux distributions. Binary database under /var/log/journal/.
- Plaso / Log2timeline
- The cross-artifact super-timeline tool. log2timeline.py extracts events from many sources into a .plaso storage file; psort.py renders the timeline to CSV or...
- SUID / SGID
- Set-User-ID and Set-Group-ID permission bits. A SUID binary runs with the owner's privileges regardless of the invoking user. A common persistence and...