user tracking

[sinck@ugive.com]

\_ Hey guys.
\_ 	At login I get a printout of when the last login occured.  Where
\_ is that info stored?  I want to check out a user on the system but
\_ don't want to log in as them.  One of the machines I work with had the
\_ root account compromised.  It's just running a few mushes so it's not that
\_ big of deal but I don't want it happening again.  I went through it with a
\_ fine tooth comb and wouldn't mind 

Try the command 'last', which references wtmp and/or utmp.  Also grep
the system logs.  :-)

David