I usually run 'w' first when troubleshooting unknown machines
Genuine question: how many HN readers log on to boxes with user accounts that belong to humans, where some state may have been mutated?My experience of the last five years is so heavily weighted to (effectively) immutable infrastructure that checking to see who had been on a box hadn't event crossed my mind.