The Linux command line provides some excellent tools for determining how frequently users log in and how much time they spend on a system. Pulling information from the /var/log/wtmp file that maintains details on user logins can be time-consuming, but with a couple easy commands, you can extract a lot of useful information on user logins.
One of the commands that helps with this is the last command. It provides a list of user logins that can go quite far back. The output looks like this:
$ last | head -5 | tr -s " " shs pts/0 192.168.0.14 Wed Aug 14 09:44 still logged in shs pts/0 192.168.0.14 Wed Aug 14 09:41 - 09:41 (00:00) shs pts/0 192.168.0.14 Wed Aug 14 09:40 - 09:41 (00:00) nemo pts/1 192.168.0.18 Wed Aug 14 09:38 still logged in shs pts/0 192.168.0.14 Tue Aug 13 06:15 - 18:18 (00:24)
Note that the tr -s ” “ portion of the command above reduces strings of blanks to single blanks, and in this case, it keeps the output shown from being so wide that it would be wrapped around on this web page. Without the tr command, that output would look like this: