Here is an easy way to determine how many login/logout sessions were recorded for a particular workstation. I will employ a few common UNIX system administration commands to fetch, filter, and then count the information derived from the wtmpx file. And by the way, my wtmpx file has not been cleared out in awhile.
# csh
# last | grep esoft | wc -l
24
In some organizations, logging in as the root user via the console is restricted. Check to see if anyone has logged in as root via the console.
# last | grep console | grep root | wc -l
20
Recorded Reboots
# last | awk '{print $1}’ | grep reboot | wc -l
36
Number of logins for each users/pseudo users (/bin/ later added per ux-admin's suggestion)
# foreach i (`last | awk '{print $1}' | sort | uniq | grep -v wtmp`)
? /bin/echo $i `last | grep $i | wc -l`
? end
ftp 16
reboot 36
restrict 1
root 167
esoft 24
Total logins for users/pseudo users
# last | awk '{print $1}' | grep '.' | grep -v wtmp | wc -l
244