One of the data elements produced by the finger command gives information on how long a logged in session has been idle. Where does finger get that information from on RedHat? I've looked in /proc/<pid>/ but did not find anything useful, and the documentation doesn't go into the commands implementation.
So, where in the system is finger (or w) pulling this information from?
The finger program get's this information from utmp file located at /var/run/utmp.