def _ParseWtmp():
  """Parse wtmp and utmp and extract the last logon time."""
  users = {}

  wtmp_struct_size = UtmpStruct.GetSize()
  filenames = glob.glob("/var/log/wtmp*") + ["/var/run/utmp"]

  for filename in filenames:
    try:
      wtmp = open(filename, "rb").read()
    except IOError:
      continue

    for offset in range(0, len(wtmp), wtmp_struct_size):
      try:
        record = UtmpStruct(wtmp[offset:offset + wtmp_struct_size])
      except utils.ParsingError:
        break

      # Users only appear for USER_PROCESS events, others are system.
      if record.ut_type != 7:
        continue

      try:
        if users[record.ut_user] < record.tv_sec:
          users[record.ut_user] = record.tv_sec
      except KeyError:
        users[record.ut_user] = record.tv_sec

  return users
Parse wtmp and utmp and extract the last logon time.