I'm trying to understand how the

last

command works on Mac and the table spec refers to a fuzzed "/var/log/wtmpx" path? it seems to be include'ing <utmpx.h>, and I don't know what that translates to on the file system if there is a (binary or log or otherwise) artifact I'd confirm with. One way or the other, even if I'm trusting the OS itself and not a filesystem artifact, I am trying to understand retention because it seems to be getting purged/trimmed on a schedule I don't understand

I’m not going digging through source code. Some high level stuff… unix machines store last login information in the

utmpx

or

wtmpx

system. That is probably the authoritative place to look. (unlike the macOS plist mirroring weirdness) The fuzz path is linux specific, not macOS anyhow. You would need to dig through the OS definitions for this