In Linux Mint, I know that I can use the
last terminal command to view when a user last logged into their machine.
In my job, however, I often work with employees who leave each day by simply pressing "Switch Users" rather than actually logging out of their profiles to close all their tasks out of memory. This has caused a few manifestations of memory leaks. Is there a way to parse precisely how an employee last logged into their workstation and thereby identify whether the employee last used the "Switch Users" option to get back to the login screen? As far as I can tell,
last simply tells me that the employee entered their password at the login screen, and not necessarily whether their environment was still loaded from before.
tl;dr: How can I tell whether a user has logged in after "Switch Users," rather than them actually logging out all the way?