The utmp file records information about who is currently using the system. The file is a sequence of utmp entries, as defined in struct utmp in the utmp.h file.
The utmp structure gives the name of the special file associated with the user's terminal, the user's login name, and the time of the login in the form of time(3). The ut_type field is the type of entry, which can specify several symbolic constant values. The symbolic constants are defined in the utmp.h file.
The wtmp file records all logins and logouts. A null user name indicates a logout on the associated terminal. A terminal referenced with a tilde (~) indicates that the system was rebooted at the indicated time. The adjacent pair of entries with terminal names referenced by a vertical bar (|) or a right brace (}) indicate the system-maintained time just before and just after a date command has changed the system's time frame.
The wtmp file is maintained by login(1) and init(8). Neither of these programs creates the file, so, if it is removed, record keeping is turned off. See ac(8) for information on the file.
login(1), who(1), ac(8), init(8), last(8), lastcomm(8) delim off