Check whether user logged in after hitting "Switch Users"

Question

In Linux Mint, I know that I can use the last terminal command to view when a user last logged into their machine.

In my job, however, I often work with employees who leave each day by simply pressing "Switch Users" rather than actually logging out of their profiles to close all their tasks out of memory. This has caused a few manifestations of memory leaks. Is there a way to parse precisely how an employee last logged into their workstation and thereby identify whether the employee last used the "Switch Users" option to get back to the login screen? As far as I can tell, last simply tells me that the employee entered their password at the login screen, and not necessarily whether their environment was still loaded from before.

tl;dr: How can I tell whether a user has logged in after "Switch Users," rather than them actually logging out all the way?

Answer 1

The "w" (or who) command will show the currently logged in users. For example:

doug@LinuxMint ~ $ w
 12:23:36 up 41 min, 2 users, load average: 0.69, 0.24, 0.15
USER     TTY     FROM     LOGIN@     IDLE    JCPU     PCPU WHAT
doug     tty7    :0       11:42     40:54    7.39s    0.07s cinnamon-session
test     tty8    :20      12:23     40:54    0.97s    0.04s cinnamon-session

In this example user "test" was logged in, and I used switch user to log in as "doug" and run the "w" command.

If you just want the user names, you can use the "users" command which will just print the user names:

doug@LinuxMint ~ $ users
doug test

As for how they logged in, you could check for environmental variables such as SSH_CONNECTION, SSH_CLIENT, REMOTEHOST, DISPLAY, and SESSIONNAME to see.