On 64-bit
$this->bbcode_second_pass_code('', '
$ date
Sun Aug 14 14:27:07 EDT 2022
$ uptime
14:28:53 up 34 min, 1 user, load average: 0.00, 0.02, 0.26
$ yay -Qo /usr/bin/who
/usr/bin/who is owned by coreutils 9.1-1
$ who -b
system boot Aug 14 13:54
$ who -a
system boot Aug 14 13:54
LOGIN ttyAMA0 Aug 14 13:55 296 id=AMA0
LOGIN tty1 Aug 14 13:55 295 id=tty1
user + pts/0 Aug 14 13:55 . 301 (10.10.10.10)
$ df -hT /run/utmp
Filesystem Type Size Used Avail Use% Mounted on
run tmpfs 483M 628K 482M 1% /run
')
On 32-bit armv7l
$this->bbcode_second_pass_code('', '
$ date
Sun Aug 14 14:21:41 EDT 2022
$ uptime
14:28:49 up 1 day, 6:22, 1 user, load average: 0.00, 0.00, 0.00
$ who -b
system boot Jan 12 00:49
$ yay -Qo /usr/bin/who
/usr/bin/who is owned by coreutils 9.1-1
$ who -a
system boot Jan 12 00:49
LOGIN ttyS0 Jan 1 11:00 6081 id=tyS0
LOGIN tty1 Jan 2 16:14 270 id=tty1
user + pts/0 Jun 3 19:36 . 7624 (10.10.10.10)
$ df -Th /run/utmp
Filesystem Type Size Used Avail Use% Mounted on
tmpfs tmpfs 198M 49M 150M 25% /run
')
The system has been up for one day in August yet who shows it booted in January and it shows I logged in back in June.
df shows that utmp is on tmpfs so it could not have any residue in it from before the system booted.
The /run/utmp file is created at boot by systemd-tmpfiles.
$this->bbcode_second_pass_code('', '
$ systemd-tmpfiles --cat-config | grep /run/utmp
F! /run/utmp 0664 root utmp -
')
The "F" is somewhat undocumented. I was able to find a description in the source code.
$this->bbcode_second_pass_code('', '
$ grep TRUNCATE_FILE tmpfiles.c |head -n 1
TRUNCATE_FILE = 'F', /* deprecated: use f+ */
')
The "!" is in the man page for tmpfiles.d and it means "only at boot".