Login accounting records the users currently logged in, as well as all past logins. This information is maintained in three files: the utmp file, which maintains a record of all currently logged-in users; the wtmp file, which is an audit trail of all logins and logouts; and the lastlog file, which records the time of last login for each user. Various commands, such as who and last, use the information in these files.
The C library provides functions to retrieve and update the information in the login accounting files. Applications providing login services should use these functions to update the login accounting files, so that commands depending on this information operate correctly.
Aside from the utmp(5) manual page, the most useful place to find further information about the login accounting functions is in the source code of the various applications that use these functions. See, for example, the sources of mingetty (or agetty), login, init, telnet, ssh, and ftp.