also if this is for unix, you may want to look at Sys::Utmp which give you direct access to the data that is parsed by who. You can get more info that who gives you about current activities on the system.

-Waswas