Linux command logged users

6 commands to list the logged in users in Linux

But how will you check the complete list of logged in users either current or all those attempts which have been made to connect your machine by any user and the status of connection

Here are 6 commands which I use to view the users who have logged in recently or are currently logged in to any particular Linux machine

Method 1

Method 2

last: This command searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created. Names of users and tty’s can be given, in which case last will show only those entries matching the arguments.

# last -a
deepak pts/3 Tue Oct 16 18:01 – 18:01 (00:00) 10.10.10.30
root pts/2 Tue Oct 16 17:51 still logged in 10.10.10.30
root pts/1 Tue Oct 16 14:29 – 18:03 (03:34) 10.10.10.30
root pts/3 Tue Oct 16 11:10 – 13:11 (02:00) 10.10.10.30
root pts/1 Mon Oct 15 20:30 – 13:21 (16:51) 10.10.10.30
root pts/3 Mon Oct 15 18:02 – 18:37 (00:34) 10.10.10.30
root pts/1 Mon Oct 15 15:23 – 18:34 (03:11) 10.10.10.30
root pts/1 Mon Oct 15 10:45 – 15:22 (04:36) 10.10.10.30
root pts/2 Fri Oct 12 18:34 – 15:53 (3+21:19) :2.0
root pts/1 Fri Oct 12 18:07 – 19:34 (01:27) 10.10.10.30
root pts/0 Fri Oct 12 17:57 still logged in :0.0
root tty1 Fri Oct 12 17:56 still logged in :0
reboot system boot Fri Oct 12 17:44 – 18:03 (4+00:19) 2.6.32-220.el6.i686

Method 3

Method 4

finger: If no arguments are specified, finger will print an entry for each user currently logged into the system.

Method 5

who: This command shows currently logged in users with time details

Источник

How to show current logged in users in Linux

All user names are stored in /etc/passwd file and can be displayed with help of cat command or grep command/egrep command:
cat /etc/passwd
grep ‘^userNameHere’ /etc/passwd
grep ‘^tom’ /etc/passwd
Let us see all examples and usage in details.

How to show current logged in users in Linux

• The current time ( 22:11:17 )
• How long the Linux server has been running (18 days)
• How many users are currently logged on Linux (2 users)
• The system load averages for the past 1, 5, and 15 minutes (1.01, 1.04, 1.05)

The following info displayed for each current logged in user:

• No ads and tracking
• In-depth guides for developers and sysadmins at Opensourceflare✨
• Join my Patreon to support independent content creators and start reading latest guides:
  • How to set up Redis sentinel cluster on Ubuntu or Debian Linux
  • How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)
  • How to set up Mariadb Galera cluster on Ubuntu or Debian Linux
  • A podman tutorial for beginners – part I (run Linux containers without Docker and in daemonless mode)
  • How to protect Linux against rogue USB devices using USBGuard

Join Patreon ➔

• sweta – Login name
• pts/10 – The tty name
• minitx – The remote host/desktop/laptop name
• 22:11 – Login time
• 5.00s – Idle time
• 0.04s – JCPU (it the time used by all processes attached to the tty. It does not include past background jobs, but does include currently running background jobs.)
• 0.02s – PCPU (it is the time used by the current process, named in the “what” field.)
• vim replicant.py – The command line of their current process

Find out who you are currently logged in as on Linux

Execute the following command:
whoami
Another option is to just type the following id command:
id

Use the whoami and id commands to find out who you are currently logged in as on Linux based system

Linux show who is logged on

Conclusion

This page showed how to find out current logged in users in Linux and what they are doing from the terminal. For more info see man pages using the man command:
man w
man who
man whoami

🐧 Get the latest tutorials on Linux, Open Source & DevOps via

Источник

UNIX / Linux List Current Logged In Users

H ow do I print the user names of users currently logged in to the current UNIX / Linux host / server from a command prompt?

You need to use any one of the following command line tools to list currently logged in users on Linux or Unix-like systems.

Tutorial details
Difficulty level	Easy
Root privileges	Yes
Requirements	w or who command on Linux and Unix
Est. reading time	5m

The following two file keep login records on Linux and Unix-like systems:

• /var/run/utmp – Keeps and allows us to discover information about who is currently using the system. Please note that there may be more L inux and Unix users currently using the system, because not all programs use utmp logging . In other words, poorly written app, hidden programs, malware, and other bad stuff will not be useful to list logged in users.
• /var/log/wtmp – Keeps records all logins and logouts.

We simply cannot read these files using cat command/grep command/egrep command as file is in binary database format. Hence, we use the following commands to find currently logged in users in Linux and Unix-like systems.

Linux Command To List Current Logged In Users

1. w command – Shows information about the users currently on the machine, and their processes.
2. who command – Display information about users who are currently logged in.
3. users command – See the login names of the users currently on the system, in sorted order, space separated, on a single line. It reads all information from /var/run/utmp file.

How to find currently logged in users in Linux

Open a terminal (or login into remote server using ssh command) and type the following commands.

Using w command to list current logged in users under Unix or Linux

Open the terminal application and then type the w command:
$ w

Fig.01: w command in action.

Understanding w command outputs

From Fig.01 we see the following for each user:

• USER – Linux or Unix login name.
• TTY – The tty name.
• FROM The remote host or IP address.
• @Login – Login time.
• IDEL – Idle time.
• JCPU – The JCPU time is the time used by all processes attached to the tty. However, it does not include past background jobs, but does include currently running background jobs.
• PCPU – The PCPU time is the time used by the current process, named in the “what” field.
• WHAT – The command line of that users current process.

To see info about a user named tom, enter:
$ w tom
Tell w command not print header:
$ w -h
$ w —no-header
We can also ignore current process username by passing the -u or —no-current to the w command:
$ w -u
$ w —no-current
Want to see remote hostname field? Try:
$ w -f
Show IP address instead of hostname for from field:
$ w -i
We can also old style output. In other words old outputs prints blank space for idle times less than one minute:
$ w -o

Display all logged in users using who command

The who command works on all Unix like operating systems such as macOS, *BSD, Linux and so on. The syntax is pretty simple:
# who
Here is what we see:

The who command displays the following information:

• root – The username
• pts/0 – Type of the terminal device. In this example, we see pseudoterminal pts/0 used by root user.
• 2013-03-12 15:10 – User login date and time stamp.
• (10.1.3.177) – The remote IP address from which the user logged into this server.

We can pass the -a option to who command as follows to see time of last system boot, display dead processes, system login processes, active processes spawned by init/systemd, print current runlevel, print last system clock change, show user’s message status, and list users logged in to Linux or Unix box:
# who -a
Here is output from older Linux system (pre Systemd):

Sample outputs from Systemd based Linux sysetem:

Getting help with the whois command

You can pass the following options to the who command (taken from the who command man page):

• No ads and tracking
• In-depth guides for developers and sysadmins at Opensourceflare✨
• Join my Patreon to support independent content creators and start reading latest guides:
  • How to set up Redis sentinel cluster on Ubuntu or Debian Linux
  • How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)
  • How to set up Mariadb Galera cluster on Ubuntu or Debian Linux
  • A podman tutorial for beginners – part I (run Linux containers without Docker and in daemonless mode)
  • How to protect Linux against rogue USB devices using USBGuard

Join Patreon ➔

users command

Open a terminal or login over the ssh session and enter the following users command:
$ users
Output who is currently logged:

Vieing logged in users with last command

Want to see a listing of last logged in users? Use the last command to lookup binary database called /var/log/wtmp and displays a list of all users logged in (and out) since that file was created. For instance see history for user named ‘vivek’:
$ last vivek

Источник

How to check user’s login history in Linux?

Linux is a multi-user operating system and more than one user can be logged into a system at the same time.

For some reason, you may be required to check login history to identify those who have logged into the system recently or within a certain period of time.

This can be done in multiple ways and we will show you how to check the user login history in detail using the last command in this article. However, we will also provide you with a summary of the other commands.

It contains a bunch of useful information about the user such as user name, name of the terminal connected, source IP (from which IP address the user has accessed the system), date, time and how long the user has been logged into the system.

It will help us to analyze certain types of issues. For example, if some files are removed at a particular time and we can enquire the users who logged into the system during that time for first-level troubleshooting.

All source files are located in the following location and these are binary files that cannot be viewed in any text editor.

• /var/run/utmp: It contains information about the users who are currently logged onto the system. Who command is used to fetch the information from the file.
• /var/log/wtmp: It contains historical utmp. It keeps the users login and logout history. The last command uses this file to display the information.
• /var/log/btmp: It contains bad login attempts.

Alternatively, user login information can be verified using the aureport tool, which generates summary reports of the user’s login history.

What is last command?

last command searches the user information from the ‘/var/log/wtmp’ file and displays a list of all users who have logged in and out since the file was created.

What is lastb command?

lastb command is the same as last command, by default it shows the log of the file ‘/var/log/btmp’ file, which contains all bad login attempts.

Difference between pts and tty

You may have seen pts and tty values in the who command output and the below explanation will show the difference between them.

• A tty stands for TeleTYpe is a native terminal device (It could be a server/system console).
• A pty (pseudo terminal device) is a terminal device that is emulated by another program such as putty, xterm or screen, etc,.

1) Checking login history of all logged users in Linux

Run the ‘last’ command without any arguments to view the history of all the successful login in the system.

If it has a lot of values, use less or more command to view them page wise.

2) Checking login history for a particular user

If you want to see the history of a particular user, use the below command. Replace ‘user_name’ with the desired username you want to verify.

3) How to check login history for a particular period in Linux?

If you want to verify who has been logged into the system for a particular period of time, use the following format.

If you want to verify that a given user has been logged into the system for a period of time, use the following format.

4) Checking login history based on a terminal connected

If you want to check the users based on the terminal connected. Use the following format.

5) How to check bad login history in Linux?

lastb command is used to check the user’s bad login history in Linux. It can also be used to view details from their archived files.

Execute the following command to suppress the hostname information in the output.

Display full user and domain names in the output.

Method-2: Checking login history using the log files

Users can manually view the login history from the following log files which containing success, failure and bad login.

• /var/log/secure – Red Hat based systems
• /var/log/auth.log – Debian based systems

Use the below format to check successful login details on RHEL, CentOS, Oracle Linux and Fedora systems.

Use the below format for failed attempts.

Use the below format to check successful and failed login details on Debian and Ubuntu systems.

Method-3: Checking login history using lastlog command

The lastlog command reports the user’s last login information by retrieving the details from the ‘/var/log/lastlog’ file.

Источник

How to see Logged in Users in Linux

Have you ever been curious about who is logged in to your Linux system? You can always list all the users on your Linux system but not all of them would be logged in all the time.

If you are on a multi-user Linux environment like a Linux server, checking logged in users could be useful and fun at the same time.

In this tutorial, I’ll show you various ways you list logged in users in Linux.

4 Commands to see logged users on Linux

Almost all these commands rely on the data stored in the /var or /proc directory. If you know a little about the directory structure in Linux, you know that these two directories contains data about the running processes on your system.

1. Use w command to see logged in users in Linux

Can it get any simpler than this? Just type a single letter command in the terminal and it will show the currently logged users in Linux.

And here is the output for the w command:

Let me explain a few terms in the output of the w command. The same terms would be used in other commands as well.

TTY gives you information about the terminal used to log on. pts means pseudo terminal slave which indicates that the user logged in via SSH connection.

It shows the IP address of the user’s computer, login time. You can also see for how long a user has been idle (slacking at work? :D).

JCPU is the time used by all processes attached to the TTY and PCPU is the time used by the current process running by the user. You can see this current process under WHAT column.

2. Check who is logged in with who command

Who command is another simple one. Just type who and it will show who is logged on to your Linux system currently.

You can also see the login time and the IP address of the logged on user.

3. Just get logged in users with users command

All the commands you saw so far give you a lot of information about the logged in users. If you are working on a script and want to know just the name of the logged in users, parsing the output of those commands would be an additional and somewhat complicated task.

This is where the users command can help you. This command only outputs the logged in users, nothing else.

4. Using finger command to see logged in users

You may need to install finger command first because not all Linux distributions have it installed by default.

It is available in the universe repository of Ubuntu and you can install it with this command:

Once installed, just type finger in terminal:

And you’ll see who is logged in on your Linux system.

Bonus Tip: see who logged on your system since last reboot

What you saw so far was about the currently logged in users. How would you know if a user logged out?

The last command in Linux gives you information about all the users who logged in to the system since last reboot. It will also show the log in and log out time of the logged out users.

Here’s the output of the last command which is self-explanatory I believe.

I hope this quick tutorial helped you in finding the users currently logged on to your Linux system. If you know some other way to do it, please share your trick with us in the comment section.

Источник