A user is suspected of violating policy by logging in to a Linux VM during non-business hours. Which of the following system files is the best way to track the...