In Linux Mint, I know that I can use the last terminal command to view when a user last logged into their machine.

In my job, however, I often work with employees who leave each day by simply pressing "Switch Users" rather than actually logging out of their profiles to close all their tasks out of memory. This has caused a few manifestations of memory leaks. Is there a way to parse precisely how an employee last logged into their workstation and thereby identify whether the employee last used the "Switch Users" option to get back to the login screen? As far as I can tell, last simply tells me that the employee entered their password at the login screen, and not necessarily whether their environment was still loaded from before.

tl;dr: How can I tell whether a user has logged in after "Switch Users," rather than them actually logging out all the way?

  • 4
    I think the w command should identify to you whether the user is logged in or not. If they have used 'switch user', they'll still be occupying a TTY somewhere on the system, but if they logged out, they should not occupy a TTY. – Klaatu von Schlacker Oct 12 '15 at 22:27

The "w" (or who) command will show the currently logged in users. For example:

doug@LinuxMint ~ $ w
 12:23:36 up 41 min, 2 users, load average: 0.69, 0.24, 0.15
doug     tty7    :0       11:42     40:54    7.39s    0.07s cinnamon-session
test     tty8    :20      12:23     40:54    0.97s    0.04s cinnamon-session

In this example user "test" was logged in, and I used switch user to log in as "doug" and run the "w" command.

If you just want the user names, you can use the "users" command which will just print the user names:

doug@LinuxMint ~ $ users
doug test

As for how they logged in, you could check for environmental variables such as SSH_CONNECTION, SSH_CLIENT, REMOTEHOST, DISPLAY, and SESSIONNAME to see.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.