Go to main content

man pages section 1M: System Administration Commands

Exit Print View

Updated: July 2017



utmpd - utmpx monitoring daemon


utmpd [-debug]


The utmpd daemon monitors the /var/adm/utmpx file. See utmpx(4) (and utmp(4) for historical information).

utmpd receives requests from pututxline(3C) by way of a named pipe. It maintains a table of processes and uses poll(2) on /proc files to detect process termination. When utmpd detects that a process has terminated, it checks that the process has removed its utmpx entry from /var/adm/utmpx. If the process' utmpx entry has not been removed, utmpd removes the entry. By periodically scanning the /var/adm/utmpx file, utmpd also monitors processes that are not in its table.



Run in debug mode, leaving the process connected to the controlling terminal. Write debugging information to standard output.

Exit Status

The following exit values are returned:


Successful completion.


An error occurred.



You can set default values for the flags listed below. For example: SCAN_PERIOD=600


The number of seconds that utmpd sleeps between checks of /proc to see if monitored processes are still alive. The default is 300.


The maximum number of processes that utmpd attempts to monitor. The default value is 4096.


The number of seconds that utmpd sleeps between read accesses of the wtmpx file. The wtmpx file's last access time is used by init(1M) on reboot to determine when the operating system became unavailable. The default is 60.


File containing user and accounting information for commands such as who(1), write(1), and login(1).


Directory containing files for processes whose utmpx entries are being monitored.


See attributes(5) for descriptions of the following attributes:


See Also

svcs(1), init(1M), svcadm(1M), poll(2), pututxline(3C), proc(4), utmp(4), utmpx(4), attributes(5), smf(5)


If the filesystem holding /var/adm/wtmpx is mounted with options which inhibit or defer access time updates, an unknown amount of error will be introduced into the utmp DOWN_TIME record's timestamp in the event of an uncontrolled shutdown (for example, a crash or loss of power ). Controlled shutdowns will update the modify time of /var/adm/wtmpx, which will be used on the next boot to determine when the previous shutdown ocurred, regardless of access time deferral or inhibition.

The utmpd service is managed by the service management facility, smf(5), under the service identifier:


Administrative actions on this service, such as enabling, disabling, or requesting restart, can be performed using svcadm(1M). The service's status can be queried using the svcs(1) command.