What does the who command do?
Shows currently logged-in users.
What details does who display?
Username, terminal (TTY), login time, and source IP or hostname.
Example output for who?
alice pts/0 2025-04-24 10:23 (:0); bob pts/1 2025-04-24 10:45 (192.168.1.10)
Why is who useful?
Provides quick snapshot of active user sessions.
What does the w command do?
Gives detailed view of logged-in users and their activity.
What details does w display?
System uptime, load average, user idle time, and running processes.
Why is w useful?
Monitoring real-time user behavior and system performance.
What does the lastlog command do?
Displays last login time for every user on the system.
Why use lastlog?
Helps identify inactive accounts or accounts that never logged in.
What is lastlog good for?
Auditing and cleanup of unused accounts.
What does the last command do?
Shows full login history for users, including reboots and shutdowns.
What details does last display?
Session start/end times and system events.
Why is last useful?
Ideal for deep historical audits and security investigations.
