last command will show user logins, logouts, system reboots and run level changes.
/etc/syslog.conf will show how your log files are configured. For example, it may show that
authpriv.* facilities are logged to
Your log files will probably be rotated, so in addition to looking at files such as
/var/log/auth.log, you may need to look in their older counterparts such as
zcat) where "n" could be any integer depending on how your rotation is set up.
Although the files can be manipulated by the users, sometimes you can look at ones such as
~username/.bash_history. Even files like
~username/.lesshst can have useful information if you really need to dig deep.