Simple, for example: I would want to find out the process id, and user who executes the "w" command.

1. By default

Code:

w output

2. move the w to w.org

Code:

mv /usr/bin/w /usr/bin/w.org

3. Write your own w

Dont worry, it is simple.

Code:

#!/bin/sh

echo "Process ID: $$";
echo "Login Name: $LOGNAME";

/usr/bin/w.org

This will print the required information, and then calls the original w.

4. Thus how you can do it.
You need to redirect the output to a log file, if need be and analyze it.

Hope i had given enough way to troubleshoot your issue.