This got me interested so did some digging on my 10.5 box
(my world
is still 99% 10.4 ) combined with some google. You are correct about
10.5 being different - looks like Apple deprecated the old utmp
interface (that used wtmp and lastlog).
http://developer.apple.com/documentation/Darwin/Reference/ManPages/
man5/wtmp.5.html
If I am reading things correctly, the new utmpx interface stores
stuff in /var/run/utmpx
http://developer.apple.com/documentation/Darwin/Reference/ManPages/
man5/utmpx.5.html
I didn't figure out how/when that file is rotated, though I'll admit
I only looked for about 10 minutes.