• VMware

    Learn about VMware virtualization for its products like vsphere ESX and ESXi, vCenter Server, VMware View, VMware P2V and many more

  • Linux

    Step by step configuration tutorials for many of the Linux services like DNS, DHCP, FTP, Samba4 etc including many tips and tricks in Red Hat Linux.

  • Database

    Learn installation and configuration of databases like Oracle, My SQL, Postgresql, etc including many other related tutorials in Linux.

  • 6 commands to list the logged in users in Linux

    I have already written an article to check the last login time of individual respective user and also with the commands and files which can be used to track last login attempts of individual users ( i.e both successful and failed attempts)

    But how will you check the complete list of logged in users either current or all those attempts which have been made to connect your machine by any user and the status of connection

    Here are 6 commands which I use to view the users who have logged in recently or are currently logged in to any particular Linux machine

    Method 1

    users: This command print the user names of users currently logged in to the current host without showing any much information about source, login time or any other relevant detail

    # users
    deepak ruchi aman rahul ramandeep


    Method 2

    last: This command searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created. Names of users and tty's can be given, in which case last will show only those entries matching the arguments.





    # last -a
    deepak   pts/3        Tue Oct 16 18:01 - 18:01  (00:00)     10.10.10.30
    root     pts/2        Tue Oct 16 17:51   still logged in    10.10.10.30
    root     pts/1        Tue Oct 16 14:29 - 18:03  (03:34)     10.10.10.30
    root     pts/3        Tue Oct 16 11:10 - 13:11  (02:00)     10.10.10.30
    root     pts/1        Mon Oct 15 20:30 - 13:21  (16:51)     10.10.10.30
    root     pts/3        Mon Oct 15 18:02 - 18:37  (00:34)     10.10.10.30
    root     pts/1        Mon Oct 15 15:23 - 18:34  (03:11)     10.10.10.30
    root     pts/1        Mon Oct 15 10:45 - 15:22  (04:36)     10.10.10.30
    root     pts/2        Fri Oct 12 18:34 - 15:53 (3+21:19)    :2.0
    root     pts/1        Fri Oct 12 18:07 - 19:34  (01:27)     10.10.10.30
    root     pts/0        Fri Oct 12 17:57   still logged in    :0.0
    root     tty1         Fri Oct 12 17:56   still logged in    :0

    reboot   system boot  Fri Oct 12 17:44 - 18:03 (4+00:19)    2.6.32-220.el6.i686

    Method 3

    secure file: This file contains the logs of all the attempts made for login to your machine with authentication reports

    # less /var/log/secure
    Oct 16 18:01:12 localhost unix_chkpwd[3503]: password check failed for user (deepak)
    Oct 16 18:01:14 localhost sshd[3501]: Failed password for deepak from 10.10.10.30 port 2326 ssh2
    Oct 16 18:01:21 localhost passwd: pam_unix(passwd:chauthtok): password changed for deepak
    Oct 16 18:01:21 localhost passwd: gkr-pam: couldn't update the 'login' keyring password: no old password was entered
    Oct 16 18:01:24 localhost sshd[3501]: Accepted password for deepak from 10.10.10.30 port 2326 ssh2
    Oct 16 18:01:24 localhost sshd[3501]: pam_unix(sshd:session): session opened for user deepak by (uid=0)
    Oct 16 18:01:31 localhost sshd[3501]: pam_unix(sshd:session): session closed for user deepak



    Method 4

    finger: If no arguments are specified, finger will print an entry for each user currently logged into the system.
    # finger
    Login     Name       Tty      Idle  Login Time   Office      Office Phone
    deepak               pts/3          Oct 16 18:01 (10.10.10.30)
    root      root       tty1       4d  Oct 12 17:56 (:0)
    root      root       pts/0    6:51  Oct 12 17:57 (:0.0)
    root      root       pts/1    2:08  Oct 16 14:29 (10.10.10.30)
    root      root       pts/2          Oct 16 17:51 (10.10.10.30)

    Method 5

    who: This command shows currently logged in users with time details

    # who -u
    root     tty1         2012-10-12 17:56  old         1960 (:0)
    root     pts/0        2012-10-12 17:57 06:51        2376 (:0.0)
    root     pts/1        2012-10-16 14:29 02:09        3094  (10.10.10.30)
    root     pts/2        2012-10-16 17:51   .          3454 (10.10.10.30)

    Method 6

    whoami: Print the user name associated with the current effective user ID
    Deepak Prasad

    is a techie and an author who is still trying to survive in this IT generation with very little knowledge he has on Linux/Unix, VMware, SAN Storage, Automation, networking etc

    You can follow him on Facebook or Google+


    Do you also have something to share here?
    Join GoLinuxHub Team as an Author, Click here for more information
    6 commands to list the logged in users in Linux 6 commands to list the logged in users in Linux Reviewed by Deepak Prasad on Monday, August 13, 2012 Rating: 5

    No comments:

    Powered by Blogger.