utmp
is usually sparse - its records are indexed by the major+minor device numbers of the controlling terminal of the session. This ensures that "stale" records that fail to be erased during logout will still eventually get overwritten eventually, by the next session on the same terminal.
It can safely be erased each time the system is booted; arguably it should be /run/utmp
but most distros don't put it there (yet).
wtmp
is not normally sparse, since it's a log that's appended each time there's an event. Since its records are a fixed size, it's easy to read them in reverse order to show "most recent first".
Both files have the same record format, so you can use less -f /var/log/whatever
to read from a particular file.
It doesn't do any harm if wtmp
is sparse, since the holes just read as all-bytes-zero which is just ignored. However holes may indicate lost records due to an abrupt system shutdown (metadata flushed but content lost).
The x
suffixed variants have a larger record structure (the old ones didn't have room to hold an entire IPv6 address or a reasonable FQDN), but otherwise behave similarly. Some versions of last
can read both record structures.