I’ve already written about when a user logs in what files are updated in UNIX / Linux.
In this article, you will learn more about UNIX login process such as what happens when you log in, how the logins are recorded into the UNIX system, and how you can use that information to determine who is logged on currently and who has been logged on in the past. You could use a modified version of the Perl script, for example, to provide total user-time information and charge it back to a user or department. From the article:
Explore new ways to record UNIX logins and other system activities in a number of different logs, and take advantage of this information to monitor user usage. This can be helpful from a number of perspectives, either to use for chargeback reporting or just to get an idea of how busy and active individual users are on the system to help when planning and allocating resources.