Hi,
What you are showing now with "last -n 10" is that lot's of users were logged in, but now anymore. It displays starting-time and time of logout. between the "(" it shows the total time they have been logged in, only a couple of minutes, so therefor you can only make a good example of it when someone really is logged in.
If one is "last -n 10" displays (still logged in) and of course no time of logout.
Example:
g1161d ftp server1 Thu Oct 16 10:00 still logged in
g1161d ftp server1 Thu Oct 16 09:47 - 09:47 (00:00)
sys007 pts/tc server1 Thu Oct 16 08:30 still logged in
Note that "w" and "who" are have different output. Perderabo made a very interesting remark about it once, but I can't find it anymore
Anyway, hope to have been of any help.
Regs David