filter record in utmp file