I usually run 'w' first when troubleshooting unknown machines
Genuine question: how many HN readers log on to boxes with user accounts that belong to humans, where some state may have been mutated?<p>My experience of the last five years is so heavily weighted to (effectively) immutable infrastructure that checking to see who had been on a box hadn't event crossed my mind.