In Linux everything is logged.

Most of the system logs are logged in /var/log.

This folder contains logs related to different services and applications.

In this folder we have some files such as utmp, wtmp and btmp. These files contains all the details about logins and logouts which are from local as well as from remote systems and system status such as uptime etc.

utmp will give you complete picture of user's logins and at which terminals, logouts, system events and current status of the system, system boot time (used by uptime) etc.

To see users still logged view the utmp file:

last -f /var/run/utmp

wtmp gives historical data of utmp.

To open wtmp file and view its content:

last -f /var/log/wtmp

btmp records only failed login attempts.

To view btmp file use same command:

last -f /var/log/btmp

Provide details who logged in, when they logged in and when they logged out:

last