Unlike strict System V, Linux does NOT create separate utmpx and wtmpx files. Instead:

Both APIs access the same file and return identical data on Linux. Use the utmpx API for portability to other UNIX systems.

⚠️ One key difference: The old utmp API provides reentrant versions (getutent_r(), getutid_r(), getutline_r()). The utmpx API does NOT have reentrant versions — neither in glibc nor in SUSv3.

Always include <utmpx.h> when using the utmpx API. On Linux, you may also want <paths.h> for the path constants.

#include <utmpx.h>   /* struct utmpx, all utmpx functions */
#include <paths.h>   /* _PATH_UTMP, _PATH_WTMP */

/* Optional: only needed for Linux-specific extensions */
#define _GNU_SOURCE

The _GNU_SOURCE feature test macro is needed to expose some Linux-specific constants like RUN_LVL and the ut_session field without a double-underscore prefix.

This example shows how the old and new APIs are equivalent on Linux. It opens the utmp file using both APIs (demonstrating that they’re the same thing underneath).

/* api_compare.c
 * Shows the old utmp API and new utmpx API are equivalent on Linux
 * Compile: gcc api_compare.c -o api_compare
 * Run as root or with readable utmp permissions
 */

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <utmpx.h>     /* New utmpx API (preferred) */
#include <utmp.h>      /* Old utmp API (for comparison) */
#include <paths.h>

int main(void)
{
    struct utmpx *utx;
    struct utmp  *ut;
    int utmpx_count = 0, utmp_count = 0;

    /* --- Count records using NEW utmpx API --- */
    setutxent();
    while ((utx = getutxent()) != NULL) {
        if (utx->ut_type == USER_PROCESS)
            utmpx_count++;
    }
    endutxent();

    /* --- Count records using OLD utmp API --- */
    setutent();
    while ((ut = getutent()) != NULL) {
        if (ut->ut_type == USER_PROCESS)
            utmp_count++;
    }
    endutent();

    printf("Users found via utmpx API : %d\n", utmpx_count);
    printf("Users found via utmp API  : %d\n", utmp_count);
    printf("\nBoth counts should be identical on Linux.\n");
    printf("Use utmpx API for portability to other UNIX systems.\n");

    return 0;
}

By default the utmpx functions read from /var/run/utmp. The utmpxname() function lets you switch to any other file — commonly used to read wtmp.

/* switch_utmpfile.c
 * Demonstrates utmpxname() to switch between utmp and wtmp files
 * Compile: gcc switch_utmpfile.c -o switch_utmpfile
 * Usage: ./switch_utmpfile [utmp|wtmp]
 */

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <utmpx.h>
#include <paths.h>

/* Returns a human-readable string for ut_type */
const char *type_name(short type)
{
    switch (type) {
        case EMPTY:         return "EMPTY";
        case RUN_LVL:       return "RUN_LVL";
        case BOOT_TIME:     return "BOOT_TIME";
        case NEW_TIME:      return "NEW_TIME";
        case OLD_TIME:      return "OLD_TIME";
        case INIT_PROCESS:  return "INIT_PROC";
        case LOGIN_PROCESS: return "LOGIN_PROC";
        case USER_PROCESS:  return "USER_PROC";
        case DEAD_PROCESS:  return "DEAD_PROC";
        default:            return "UNKNOWN";
    }
}

int main(int argc, char *argv[])
{
    const char *filepath;
    struct utmpx *ut;
    int count = 0;

    /* Decide which file to read based on argument */
    if (argc > 1 && strcmp(argv[1], "wtmp") == 0)
        filepath = _PATH_WTMP;
    else
        filepath = _PATH_UTMP;

    printf("Reading from: %s\n\n", filepath);

    /* Switch the file the utmpx functions will use */
    if (utmpxname(filepath) == -1) {
        perror("utmpxname");
        exit(EXIT_FAILURE);
    }

    /* IMPORTANT: utmpxname() does NOT open the file.
     * Call setutxent() to actually open/rewind it. */
    setutxent();

    printf("%-12s %-12s %s\n", "USER", "TYPE", "LINE");
    printf("%-12s %-12s %s\n", "----", "----", "----");

    while ((ut = getutxent()) != NULL) {
        printf("%-12.12s %-12s %s\n",
               ut->ut_user,
               type_name(ut->ut_type),
               ut->ut_line);
        count++;
    }

    endutxent();
    printf("\nTotal records: %d\n", count);

    return 0;
}

💡 Important: utmpxname() only records the new pathname. It closes any previously open file but does NOT open the new one. The file is opened lazily when you call setutxent() or any getutx*() function. So if you pass a bad path, you won’t see the error until the next read call.

A simple reimplementation of the who command using the utmpx API — shows only USER_PROCESS records.

/* my_who.c
 * Simple reimplementation of who(1) using utmpx API
 * Compile: gcc my_who.c -o my_who
 */

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <utmpx.h>
#include <time.h>

int main(void)
{
    struct utmpx *ut;
    char timebuf[64];
    struct tm *tm_info;

    /* Always rewind to start before scanning */
    setutxent();

    while ((ut = getutxent()) != NULL) {
        /* who only shows USER_PROCESS records */
        if (ut->ut_type != USER_PROCESS)
            continue;

        /* Format the login time */
        tm_info = localtime((time_t *)&ut->ut_tv.tv_sec);
        strftime(timebuf, sizeof(timebuf), "%b %d %H:%M", tm_info);

        /* Print: username  terminal  time  (hostname if remote) */
        printf("%-12s %-10s %s", ut->ut_user, ut->ut_line, timebuf);

        /* Show remote host if this is a remote login (e.g., ssh) */
        if (ut->ut_host[0] != '\0')
            printf("  (%s)", ut->ut_host);

        printf("\n");
    }

    endutxent();
    return 0;
}

Sample output:

ravi         tty1       Jun 05 10:30
priya        pts/0      Jun 05 11:15  (192.168.1.10)
admin        pts/1      Jun 05 09:00  (laptop.local)