1.who是如何工作的 who实际上是通过utmp文件来获取登陆用户的信息的 #include <utmp.h> 信息结构如下: #define UTMP_FILE /var/adm/utmp #define ut_name ut_user struct utmp{ char ut_user[32];//登录名 char ut_id[14]; char ut_line[32];//设备名 short ut_type;//入口类型 pid_t ut_pid;//进程id struct exit_status{ short e_termination; short e_exit; }ut_exit; time_t ut_time; char ut_host[64]; }; 2.编写实例 #include <stdio.h> #include <utmp.h> #include <fcntl.h> #include <unistd.h> #include <time.h> #define SHOWHOST void showtime(long); void show_info(struct utmp*); void show_info(struct utmp * utbufp) { if(utbufp->ut_type != USER_PROCESS) { return; } printf("% -8.8s",utbufp->ut_name); printf(" "); printf("% -8.8s",utbufp->ut_line); printf(" "); showtime(utbufp->ut_time); printf(" "); #ifdef SHOWHOST printf("(%s)",utbufp->ut_host); #endif printf("\n"); } void showtime(long timeval) { struct tm *tvp; tvp = gmtime(&timeval); printf("%d-%d-%d %d:%d",tvp->tm_year+1990,tvp->tm_mon+1,tvp->tm_mday,tvp->tm_hour,tvp->tm_min); } int main() { struct utmp current_record; int utmpfd; int reclen = sizeof(current_record); if((utmpfd = open(UTMP_FILE,O_RDONLY)) == -1) { perror(UTMP_FILE); _exit(1); } while(read(utmpfd,¤t_record,reclen) == reclen) { show_info(¤t_record); } close(utmpfd); return 0; } 3.测试实例 ./who 结果如下: root pts/0 2102-8-5 8:51 (192.168.1.100) root pts/1 2102-8-5 12:35 (192.168.1.100)