So The utmp and wtmp file records all logins and logouts.
Except the wtmp file format is exactly like utmp except that a null user name indicates a logout on the associated terminal. Furthermore, the terminal name ~ with user name shutdown or reboot indicates a system shutdown or reboot and the pair of terminal names |/} logs the old/new system time when date(1) changes it. wtmp is maintained by login(1), init(1), and some versions of getty(1). Neither of these programs creates the file, so if it is removed, record-keeping is turned off.\
Is that right? I'm I missing something?