In Linux operating systems everything is logged some where. Most of the system logs are logged in to /var/log folder. This folder contains logs related to different services and applications. In this folder we have some files such as utmp, wtmp and btmp. These files contains all the details about login’s and logout’s which are from local as well as from remote systems and system status such as uptime etc.
utmp will give you complete picture of users logins at which terminals, logouts, system events and current status of the system, system boot time (used by uptime) etc.
wtmp gives historical data of utmp.
btmp records only failed login attempts.
Provide how logged in, when they logged in and when they logged out
# last
To open wtmp file and view its content use blow command
# last -f /var/log/wtmp
To see still logged in users view utmp file use last command
# last -f /var/run/utmp
To view btmp file use same command
# last -f /var/log/btmp