Existem várias maneiras. last , who e ps são todos relevantes aqui. last é o mais completo para rastrear os logons atuais e anteriores .
Na página man de last (ênfase adicionada):
Last will list the sessions of specified users, ttys, and hosts, in reverse time order. Each line of output contains the user name, the tty from which the session was conducted, any hostname, the start and stop times for the session, and the duration of the session. If the session is still continuing or was cut short by a crash or shutdown, last will so indicate.
...
If no users, hostnames or terminals are specified, last prints a record of all logins and logouts.
Então, em vez de apenas informar sobre as sessões em andamento, last informa sobre todos logins e logouts.