The watch and tail commands provide some interesting options for examining activity on a Linux system in an ongoing manner.
That is, instead of just asking a question and getting an answer (like asking who and getting a list of currently logged in users), you can get watch to provide you with a display showing who is logged in along with updates as users come and go.