systemd-update-utmp.service, systemd-update-utmp-runlevel.service, systemd-update-utmp — Write audit and utmp updates at bootup, runlevel changes and shutdown
systemd-update-utmp.service
systemd-update-utmp-runlevel.service
/usr/lib/systemd/systemd-update-utmp
systemd-update-utmp-runlevel.service is
a service that writes SysV runlevel changes to utmp and wtmp, as
well as the audit logs, as they occur.
systemd-update-utmp.service does the same for
system reboots and shutdown requests.