Google only tell me how to read the content of the /var/log/lastlog, but I really curious to know what process is responsible to write to it?
The last_log PAM module typically maintains and updates the
pam_lastlogis a PAM module to display a line of information about the last login of the user. In addition, the module maintains the
Some applications may perform this function themselves. In such cases, this module is not necessary.