I want to know which of my users still actively use my server. The command lastlog tells me when they last logged in per ssh and spawned a shell on the server. It however does not tell me when they last successfully authorized and fetched their mails from the running dovecot IMAP server or when they last did a ssh proxyjump (via keyfile) to a computer on the internal network. I know for dovecot there is a last login plugin, however for ssh authorizations I haven't found anything...
Is there a way to get that information?
