What commands show who is logged in and recent login history?

who/w show who is logged in RIGHT NOW (w also shows what they're running); last shows the login HISTORY, and lastlog shows the single most-recent login per account.

The split is "now vs. history": for an intrusion check you'd use w/who to spot an unexpected live session, then last to see when and from where logins happened over time, and lastlog to catch an account that suddenly logged in after months of nothing. last reads /var/log/wtmp, so it survives reboots.

w output:

w
 10:30:01 up 5 days, USER  TTY   FROM         LOGIN@  IDLE  WHAT
 student pts/0 192.168.1.50  09:15  0.00s bash

last output:

last
student  pts/0  192.168.1.50  Mon Jan 27 09:15  still logged in
root     tty1                  Sun Jan 26 10:00 - 10:05 (00:05)
reboot   system boot           Sun Jan 26 09:58

lastlog output:

lastlog
Username         Port     From             Latest
root             tty1                      Sun Jan 26 10:00:00
student          pts/0    192.168.1.50     Mon Jan 27 09:15:00

Security use: Detect unauthorized logins, check when users last accessed the system.