wtmp
The binary log of logins, logouts and reboots that the last command reads, kept in /var/log/wtmp.
In more detail
Failed logins go to /var/log/btmp, read with lastb, and current sessions to utmp, read by who. Being binary, they are read with these commands rather than a text viewer.
Taught in
- Security Rounds: Special Bits, Logins, Ports And sudo — LPIC-1 Linux Administrator (101-500 and 102-500) Exam Prep