Wtmp not updating
The utmp file allows one to discover information about who is currently using the system.
There may be more users currently using the system, because not all programs use utmp logging.
If they can, they will mark it as DEAD_PROCESS on exiting and it is advised that they null ut_line, ut_time, ut_user, and ut_host as well.
Most of the system logs are logged in to /var/log folder.Clearing ut_id may result in race conditions leading to corrupted utmp entries and potential security holes.Clearing the abovementioned fields by filling them with null bytes is not required by System V semantics, but makes it possible to run many programs which assume BSD semantics and which do not modify utmp.Linux uses the BSD conventions for line contents, as documented above. Unlike various other systems, where utmp logging can be disabled by removing the file, utmp must always exist on Linux.If you want to disable who(1) then do not make utmp world readable.