Description:looking for what users are logged into a host, the user the type of auth, time and process
What The Data Shows: good for troubleshooting what user may have made changes that caused an issue, auditing purposes, or even incident response.
SQL:
SELECT type,user,host,time,pid,p.name
FROM (`logged_in_users`) JOIN processes AS p USING(pid);