> w # or better yet:last |head # who is/has been in The post argues that 'last' will not always give the desired information: > Obviously, I could also use 'l

> w # or better yet:last |head # who is/has been in The post argues that 'last' will not always give the desired information: > Obviously, I could also use 'last' to see who's been on the box recently, but this isn't the whole story. It's totally possible to "ssh root@box /path/to/command" and never start a login shell, which then leaves no trace in the lastlog, but then goes on to break something on the box. The syslog is how you'd find this.