See what your users are doing using SSH connected to your system – this will show you what happens on the first console. If someone is typing, you’ll be able to get an output of his keystrokes. Substitute cat /dev/vcs1 with cat /dev/vcs2 or cat /dev/vcs3 and so on for other consoles.
cat /dev/vcs1
Just a comment, you need to root to do that.