/var/run/utmp (w, who, finger)

/var/run/utmp contains binary data on users currently logged into the system. Data is access by commands such as 'w', 'who' and 'finger'.