systemd-update-utmp.service
systemd-update-utmp-runlevel.service
/usr/lib/systemd/systemd-update-utmp
systemd-update-utmp-runlevel.service is a service that writes SysV runlevel changes to utmp and wtmp, as well as the audit logs, as they occur. systemd-update-utmp.service does the same for system reboots and shutdown requests.
systemd(1), utmp(5), auditd(8)