General

Updated 7 November 2024

List of Logged In Users:

shell
who

Example:
who
root     pts/0        2024-11-06 15:56 (10.10.2.11)
root     pts/1        2024-11-06 14:23 (10.10.2.11)

Column 1 displays the login name of the user.

Column 2 shows the terminal session device filename (pts stands for pseudo terminal session, and tty identifies a terminal window on the console).

shell
w
 
Example: 
w
 16:03:46 up 54 days, 20:54,  2 users,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    10.10.2.11       15:56    2.00s  0.00s  0.00s w
root     pts/1    10.10.2.11       14:23    1:33m  0.04s  0.04s -bash

The w (what) command displays information in a similar format as the who command, but it also tells the length of time the user has been idle for (IDLE), along with the CPU time used by all processes including any existing background jobs attached to this terminal (JCPU), the CPU time used by the current process (PCPU), and current activity (WHAT).

Your User:

shell
whoami

Inspection of Users:

shell
last

Example:
last
root     pts/0        10.10.2.11       Wed Nov  6 15:56   still logged in   
root     pts/1        10.10.2.11       Wed Nov  6 14:23   still logged in   
root     pts/0        10.10.2.11       Wed Nov  6 13:25 - 15:36  (02:11)    
root     pts/4        10.10.2.11       Tue Nov  5 15:14 - 18:16  (03:02)

Column 1: Login name of the user Column 2: Terminal name assigned upon logging in Column 3: Terminal name or IP address from where the connection was established Column 4 to 7: Day, month, date, and time when the connection was established Column 8: Log out time. If the user is still logged on, it will say “still logged in” Column 9: Duration of the login session

shell
id

Example:
id omair
uid=502(omair) gid=502(omair) groups=502(omair)

Who Rebooted ?

shell
last reboot

Example:
last reboot
reboot   system boot  3.10.0-1160.119. Thu Sep 12 19:09 - 16:08 (54+20:58)  
reboot   system boot  3.10.0-1160.119. Wed Sep 11 19:15 - 19:09  (23:54)    
reboot   system boot  3.10.0-1160.el7. Mon Sep  9 15:02 - 19:14 (2+04:11)

Column 1: Action name (reboot) Column 2: Activity name (system boot) Column 3: Linux kernel version Column 4 to 7: Day, month, date, and time when the reboot command was issued Column 8: System restart time Column 9: Duration the system remained down. If the system is running, it will say “still running”.

Failed Login Attempts

shell
lastb

Example:
lastb
admin    ssh:notty    172.16.28.75     Wed Nov  6 10:17 - 10:17  (00:00)    
admin    ssh:notty    172.16.28.75     Wed Nov  6 10:17 - 10:17  (00:00)

Column 1: Name of the user who made the login attempt Column 2: Name of the protocol used. No tty was assigned as the attempt failed Column 3: Terminal name or IP address from where the connection attempt was launched Column 4 to 7: Day, month, date, and time of the attempt Column 8: Duration the login attempt was tried Column 9: Duration the login attempt lasted for

Spotted a mistake or want something added? Send me a note.