Use logins.log for LastSeen command and fall back to server log