In Linux Mint, I know that I can use the last
terminal command to view when a user last logged into their machine.
In my job, however, I often work with employees who leave each day by simply pressing "Switch Users" rather than actually logging out of their profiles to close all their tasks out of memory. This has caused a few manifestations of memory leaks. Is there a way to parse precisely how an employee last logged into their workstation and thereby identify whether the employee last used the "Switch Users" option to get back to the login screen? As far as I can tell, last
simply tells me that the employee entered their password at the login screen, and not necessarily whether their environment was still loaded from before.
tl;dr: How can I tell whether a user has logged in after "Switch Users," rather than them actually logging out all the way?
w
command should identify to you whether the user is logged in or not. If they have used 'switch user', they'll still be occupying a TTY somewhere on the system, but if they logged out, they should not occupy a TTY.