Ok Erik, now riddle me this... in pututline, const struct utmp *utmp_entry is passed into it.. later on it attempts write(ut_fd, (char *) utmp_entry, sizeof(utmp_entry)); won't that merely write out the address of utmp_entry? isn't proper behaviour write(ut_fd, (char *) utmp_entry, sizeof(*utmp_entry)); ?