Linux check logged in

How to show current logged in users in Linux

All user names are stored in /etc/passwd file and can be displayed with help of cat command or grep command/egrep command:
cat /etc/passwd
grep ‘^userNameHere’ /etc/passwd
grep ‘^tom’ /etc/passwd
Let us see all examples and usage in details.

How to show current logged in users in Linux

• The current time ( 22:11:17 )
• How long the Linux server has been running (18 days)
• How many users are currently logged on Linux (2 users)
• The system load averages for the past 1, 5, and 15 minutes (1.01, 1.04, 1.05)

The following info displayed for each current logged in user:

• No ads and tracking
• In-depth guides for developers and sysadmins at Opensourceflare✨
• Join my Patreon to support independent content creators and start reading latest guides:
  • How to set up Redis sentinel cluster on Ubuntu or Debian Linux
  • How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)
  • How to set up Mariadb Galera cluster on Ubuntu or Debian Linux
  • A podman tutorial for beginners – part I (run Linux containers without Docker and in daemonless mode)
  • How to protect Linux against rogue USB devices using USBGuard

Join Patreon ➔

• sweta – Login name
• pts/10 – The tty name
• minitx – The remote host/desktop/laptop name
• 22:11 – Login time
• 5.00s – Idle time
• 0.04s – JCPU (it the time used by all processes attached to the tty. It does not include past background jobs, but does include currently running background jobs.)
• 0.02s – PCPU (it is the time used by the current process, named in the “what” field.)
• vim replicant.py – The command line of their current process

Find out who you are currently logged in as on Linux

Execute the following command:
whoami
Another option is to just type the following id command:
id

Use the whoami and id commands to find out who you are currently logged in as on Linux based system

Linux show who is logged on

Conclusion

This page showed how to find out current logged in users in Linux and what they are doing from the terminal. For more info see man pages using the man command:
man w
man who
man whoami

🐧 Get the latest tutorials on Linux, Open Source & DevOps via

Источник

Linux / Unix: Check Last Time User Logged In On The System

Listing the Last times a user logged in on server

The syntax is as follows:[donotprint]

Tutorial details
Difficulty level	Easy
Root privileges	No
Requirements	None
Est. reading time	1m

[/donotprint]

• No ads and tracking
• In-depth guides for developers and sysadmins at Opensourceflare✨
• Join my Patreon to support independent content creators and start reading latest guides:
  • How to set up Redis sentinel cluster on Ubuntu or Debian Linux
  • How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)
  • How to set up Mariadb Galera cluster on Ubuntu or Debian Linux
  • A podman tutorial for beginners – part I (run Linux containers without Docker and in daemonless mode)
  • How to protect Linux against rogue USB devices using USBGuard

Join Patreon ➔

last [option] [UserNameHere]

Example: Display Linux user last login

To display when a user named ‘vivek’ last logged in to the system, type:
$ last vivek
$ last vivek | less
Sample outputs:

Fig.01: last command in action on my Debian base nas server

Display a list of recent system use for all users

Simply type the last command:
$ last
OR
$ last | less
Sample outputs taken from my RHEL based server:

See also

• I strongly suggest that you see our last command examples page.
• Read last(1) command man page.
• See /var/log/wtmp file.

🐧 Get the latest tutorials on Linux, Open Source & DevOps via

Category	List of Unix and Linux commands
Documentation	help • mandb • man • pinfo
Disk space analyzers	df • duf • ncdu • pydf
File Management	cat • cp • less • mkdir • more • tree
Firewall	Alpine Awall • CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04
Linux Desktop Apps	Skype • Spotify • VLC 3
Modern utilities	bat • exa
Network Utilities	NetHogs • dig • host • ip • nmap
OpenVPN	CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04
Package Manager	apk • apt
Processes Management	bg • chroot • cron • disown • fg • glances • gtop • jobs • killall • kill • pidof • pstree • pwdx • time • vtop
Searching	ag • grep • whereis • which
Shell builtins	compgen • echo • printf
Text processing	cut • rev
User Information	groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w
WireGuard VPN	Alpine • CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04

Comments on this entry are closed.

Thanks for the article. I tried running ‘last’ on an osx box, and it just returned “wtmp begins Mon Mar 10 10:24” which was the current date/time. Running it again gives the same response, updating the date/time. It looks to me like the last datafile is continuously wiped. Do you know what could be causing that?

How can i print only the day in last ?

A fast and simple way would be using grep. Example:

Источник

6 commands to list the logged in users in Linux

But how will you check the complete list of logged in users either current or all those attempts which have been made to connect your machine by any user and the status of connection

Here are 6 commands which I use to view the users who have logged in recently or are currently logged in to any particular Linux machine

Method 1

Method 2

last: This command searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created. Names of users and tty’s can be given, in which case last will show only those entries matching the arguments.

# last -a
deepak pts/3 Tue Oct 16 18:01 – 18:01 (00:00) 10.10.10.30
root pts/2 Tue Oct 16 17:51 still logged in 10.10.10.30
root pts/1 Tue Oct 16 14:29 – 18:03 (03:34) 10.10.10.30
root pts/3 Tue Oct 16 11:10 – 13:11 (02:00) 10.10.10.30
root pts/1 Mon Oct 15 20:30 – 13:21 (16:51) 10.10.10.30
root pts/3 Mon Oct 15 18:02 – 18:37 (00:34) 10.10.10.30
root pts/1 Mon Oct 15 15:23 – 18:34 (03:11) 10.10.10.30
root pts/1 Mon Oct 15 10:45 – 15:22 (04:36) 10.10.10.30
root pts/2 Fri Oct 12 18:34 – 15:53 (3+21:19) :2.0
root pts/1 Fri Oct 12 18:07 – 19:34 (01:27) 10.10.10.30
root pts/0 Fri Oct 12 17:57 still logged in :0.0
root tty1 Fri Oct 12 17:56 still logged in :0
reboot system boot Fri Oct 12 17:44 – 18:03 (4+00:19) 2.6.32-220.el6.i686

Method 3

Method 4

finger: If no arguments are specified, finger will print an entry for each user currently logged into the system.

Method 5

who: This command shows currently logged in users with time details

Источник

How to see Logged in Users in Linux

Have you ever been curious about who is logged in to your Linux system? You can always list all the users on your Linux system but not all of them would be logged in all the time.

If you are on a multi-user Linux environment like a Linux server, checking logged in users could be useful and fun at the same time.

In this tutorial, I’ll show you various ways you list logged in users in Linux.

4 Commands to see logged users on Linux

Almost all these commands rely on the data stored in the /var or /proc directory. If you know a little about the directory structure in Linux, you know that these two directories contains data about the running processes on your system.

1. Use w command to see logged in users in Linux

Can it get any simpler than this? Just type a single letter command in the terminal and it will show the currently logged users in Linux.

And here is the output for the w command:

Let me explain a few terms in the output of the w command. The same terms would be used in other commands as well.

TTY gives you information about the terminal used to log on. pts means pseudo terminal slave which indicates that the user logged in via SSH connection.

It shows the IP address of the user’s computer, login time. You can also see for how long a user has been idle (slacking at work? :D).

JCPU is the time used by all processes attached to the TTY and PCPU is the time used by the current process running by the user. You can see this current process under WHAT column.

2. Check who is logged in with who command

Who command is another simple one. Just type who and it will show who is logged on to your Linux system currently.

You can also see the login time and the IP address of the logged on user.

3. Just get logged in users with users command

All the commands you saw so far give you a lot of information about the logged in users. If you are working on a script and want to know just the name of the logged in users, parsing the output of those commands would be an additional and somewhat complicated task.

This is where the users command can help you. This command only outputs the logged in users, nothing else.

4. Using finger command to see logged in users

You may need to install finger command first because not all Linux distributions have it installed by default.

It is available in the universe repository of Ubuntu and you can install it with this command:

Once installed, just type finger in terminal:

And you’ll see who is logged in on your Linux system.

Bonus Tip: see who logged on your system since last reboot

What you saw so far was about the currently logged in users. How would you know if a user logged out?

The last command in Linux gives you information about all the users who logged in to the system since last reboot. It will also show the log in and log out time of the logged out users.

Here’s the output of the last command which is self-explanatory I believe.

I hope this quick tutorial helped you in finding the users currently logged on to your Linux system. If you know some other way to do it, please share your trick with us in the comment section.

Источник

How to Check Linux Login History

If you have a Linux server, there is a possibility that you have several users accessing the system. You may want to know who is logged on your system, when a particular user logged to the Linux system. You may also want to know from which IP address your system was accessed.

Even if you don’t have multiple users, someone probably have tried to access your Linux server. Trust me, this may sound weird but it’s a common thing these days for bots to try and access your Linux servers. Don’t believe me? Just check the bad login attempts on your server to see if someone tried to login to your system.

Let me show you how to view the Linux login history so that you are aware of who is accessing your system and from where.

Viewing Linux login history

Linux is very good at keeping logs of everything that goes on your system. Quite naturally, it also stores logs about login and login attempts. The login information is stored in three places:

• /var/log/wtmp – Logs of last login sessions
• /var/run/utmp – Logs of the current login sessions
• /var/log/btmp – Logs of the bad login attempts

Let’s see these things in a bit detail.

1. View history of all logged users

To view the history of all the successful login on your system, simply use the command last.

The output should look like this. As you can see, it lists the user, the IP address from where the user accessed the system, date and time frame of the login. pts/0 means the server was accessed via SSH.

The last line of the output tells you the when was the wtmp log file was created. This is important because if the wtmp file was deleted recently, last command won’t be able to show history of the logins prior to that date.

You may have a huge history of login sessions so it’s better to pipe the output through less command.

2. View login history of a certain user

If you just want to see the login history of a particular user, you can specify the user name with last command.

You’ll see the login information of only the selected user:

3. Display IP addresses in login history instead of hostname

You couldn’t see it in the previous output but by default, last command shows the hostname instead of the IP address of the user. If you are on a sub-network, you’ll probably see only the hostnames.

You can force to display the IP addresses of the previously logged users with the -i option.

4. Display only last N logins

If your system has a good uptime, perhaps your login history would be huge. As I mentioned earlier, you can use the less command or other file viewing commands like head or tail.

Last command gives you the option to display only certain number of login history.

Just replace N with the number you want. You can also combine it with the username.

5. View all the bad login attempts on your Linux server

Now comes the important part: checking the bad login attempts on your server.

You can do that in two ways. You can either use the last command with the btmp log file:

or you can use the lastb command:

Both of these commands will yield the same result. The lastb is actually a link to the last command with the specified file.

Bad logins could be an incorrect password entered by a legitimate user. It could also be a bot trying to brute force your password.

You have to analyze here and see if you recognize the IPs in the log. If there has been too many login attempts from a certain IP with user root, probably someone is trying to attack your system by bruteforcing.

You should deploy Fail2Ban to protect your server in such cases. Fail2Ban will ban such IPs from your server and thus giving your server an extra layer of protection.

Conclusion

I hope this tutorial teach you to view login history in Linux and now you can use this knowledge to better manage and protect your Linux system.

If you liked this article, please share it on social media and subscribe to our newsletter for more Linux related tutorials.

Источник