A resposta mais simples é last(1):
Post original: lastbleonard@opensolaris:~$ last karl
karl pts/5 10.0.1.9 Thu Jul 15 11:12 still logged in
karl sshd 10.0.1.9 Thu Jul 15 11:12 still logged in
karl pts/5 opensolaris Thu Jul 15 11:11 - 11:12 (00:00)
karl sshd opensolaris Thu Jul 15 11:11 - 11:12 (00:00)