Linux get active users

How to see users currently logged in to Linux

Linux is a multi-user operating system that allows multiple users to access the system at the same time.

As a Linux system administrator, you have to check who are logged into the system before starting to work on any issues, especially when you have a team members spread across multiple locations. Because, if multiple users are making the changes in the same configuration file, it may create additional problems.

So, make sure nobody is currently working on the issue before you take it up. To avoid these things, we need to check who all are logged into the system and what are they doing.

In this tutorial, we will show you how to check the current logged-in users with several commands in Linux.

Knowing more than one command to find the same information will not hurt you, and do not hesitate to check the alternate options.

Method-1: Checking logged-in users with ‘w’ command

‘w command’ shows who are logged-in and what are they doing. It displays information about current users on the machine by reading the file /var/run/utmp , and their processes /proc .

w command output comes with header information, which displays system activity such as current time, system up time, how many users are currently logged-in, and the system load (which averages for the past 1, 5, and 15 minutes)

w command contains the following values:

login user name, tty number, remote host, user’s login time, idle time, JCPU (time used by all processes attached to the tty), PCPU (time used by the current process), and which commands are currently being executed by the users. Please see below:

# w 17:13:34 up 1:52, 1 user, load average: 0.11, 0.18, 0.15 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root pts/0 203.99.204.108 15:22 6.00s 0.18s 0.00s w

Method-2: Identifying who is Logged-in using ‘who’ command

‘who command’ shows information about users who are currently logged in. It uses ‘/var/run/utmp’ & ‘/var/log/wtmp’ files to get those details.

• /var/run/utmp: It contains information about the users who are currently logged onto the system. Who command is used to fetch the information from the file.
• /var/log/wtmp: It contains historical utmp. It keeps the users login and logout history. The last command uses this file to display the information.

who command output contains the following values such as login user name, tty number, date & time, and remote host.

# who root pts/0 2017-05-31 15:22 (203.99.204.108)

Method-3: How to see Logged in users with ‘whoami’ command

whoami is basically the concatenation of the strings “who”,”am”,”i” as whoami. It displays the username of the current user. It’s similar to running the id command with the options -un as shown below:

Also, when you use whoami with space (who am i) that will give you a different output. It will display more details compared to whoami command as shown below:

$ who am i daygeek pts/1 2019-06-17 22:01 (192.168.1.6)

“id” command prints user and group information for a specified username, but we can add -un option with the “id” command to display all the currently logged-in users as shown below:

Method-4: Using users command

‘users command’ prints the usernames of users currently logged in to the current host. It uses /var/run/utmp & /var/log/wtmp files to get the details as shown below:

Method-5: Show currently logged-in users with ‘finger’ command

‘finger’ is a utility, which allows users to see the information about system users (login name, home directory, name, how long they’ve been logged in to the system, etc.).

Finger utility is available in all major Linux distributions, but it doesn’t come installed by default. Use distribution package manager to install “finger” on your system.

$ finger Login Name Tty Idle Login Time Office Office Phone magi daygeek tty7 7 Jun 1 16:05 (203.99.204.108)

Bonus Tips

Additionally, you can use the following methods to identify who all are logged-in on your system:

Bonus Tips-1: How to show current logged-in users with ‘last’ command

‘last command’ shows a list of last logged in users by searching the data from /var/log/wtmp file. Also, it shows the system reboot information.

“last” command output contains login user name, tty number, remote host, date, login time, logout time, and the total duration (working time).

Run the following command to show who all logged-in today. Also, you can check who’s currently logged in by filtering with the “still logged in” string.

# last -p today linuxgee tty2 tty2 Thu Mar 4 14:27 gone - no logout linuxgee : : Thu Mar 4 14:27 gone - no logout

Bonus Tips-2: Manual Way to check who’s logged-in

Last but not the least, we can get a list of logged in users on Linux machine manually by using less commands or more commands or head command or tail command, followed by the log file location.

User authentication logs are located @ /var/log/secure for RHEL based systems & /var/log/auth.log for Debian based systems.

$ head -5 /var/log/auth.log Jun 1 16:05:01 daygeek CRON[1944]: pam_unix(cron:session): session opened for user root by (uid=0) Jun 1 16:05:01 daygeek CRON[1944]: pam_unix(cron:session): session closed for user root Jun 1 16:05:44 daygeek lightdm: pam_unix(lightdm-greeter:session): session closed for user lightdm Jun 1 16:05:44 daygeek lightdm: pam_unix(lightdm:session): session opened for user magi by (uid=0) Jun 1 16:05:44 daygeek systemd: pam_unix(systemd-user:session): session opened for user magi by (uid=0)

Over to You

In this guide, you learnt how to find out who all are currently logged-in on your Linux system employing different commands.

If you found this article helpful, please do share with your friends and spread the knowledge. Please feel free to comment below if you have any queries/concerns. We will get back to you as soon as we can. Happy learning!

Источник

How can I list all currently logged-in users?

I have a system I’m managing (running RHEL 8) that has multiple users in our small office, who log into it in various ways — locally at the console, remotely via SSH and NoMachine Workstation. When I do updates that include a new kernel, or for some other reason I need to reboot the machine, I’d like to make sure there are no currently logged-in users, so I’m not interrupting users who are running software on the machine. So what I’d like to have is a command that lists all currently logged in users. I’ve done quite a bit of searching on this topic, and the methods I’ve found in response to this question are simply wrong, in the sense that they provably do not work. The commands who , w , and users do NOT list all logged-in users. As I’m writing this there are three users currently logged in to the computer in question, including myself. These commands list only one of these three (incidentally, I’m not one of them). The one user who is listed by these commands is logged in via SSH and has an open terminal. Another user who has no TTY but has several GUI applications open with their X displays piped to his laptop through SSH does not appear, and neither do I (I have a graphical login via NoMachine). In fact, who -m returns no output when I run it. I can use ps -ef to list all processes and find processes currently running for all these users. The command last | grep ‘still logged in’ (suggested here) results in the same incomplete list as above (it’s getting its information from the same source). So, repeating the question — what is the definitive method to get a list of all logged in users (users who have authenticated via the normal mechanisms, and have interactive processes currently running under their user IDs) ? I’d like to do this without searching through the output of ps . EDIT — The users on this workstation are all authenticating via LDAP, however I’ve verified that this is not related to the question. I have created a local user account, which also does not show up in response to who or users when logged in by the same means as described above.

I know you said you don’t want to use ps (hence a comment instead of an answer) but would something like ps -aux | tail -n+2 | cut -d’ ‘ -f1 | sort -u work? Of course, that also includes system users running non-interactive processes, but we can work on that if you think this is a promising avenue to pursue.

List LDAP users on linux client? suggests you need to make some changes so that LDAP users are included in the output of getent .

It’s an interesting question, but I can’t help notice the collision between «users . who have interactive processes currently running under their user IDs» and «without searching through the output of ps «. Since ps is the tool to query active processes, could you clarify why ps is not allowed?

Your requirement of «not using ps» could be easily bypassed by getting the information directly from /proc (from the same place ps gets it) grep Uid: /proc/*/status , etc 😉 Keep in mind that a user id is simply a number, and any privileged process can just setuid(some_uid) , without it having to go through pam/utmp, and without some_uid having to exist in any database, or have attached to it a name or a home directory. The only way to get a list of all active uids is to look through all the processes running on that machine.

Also, there’s no way to know if a process is «interactive» — which is a nebulous concept. Just like having «authenticated» via «normal» mechanisms.

Источник

How to List Current Logged-In Users on Linux

You can get a list of all the users who are currently logged in on your Linux system, provided you have the necessary permissions.

Readers like you help support MUO. When you make a purchase using links on our site, we may earn an affiliate commission. Read More.

Linux being a multi-user system allows multiple users to log in and run various programs at the same time. As a normal Linux user or system admin, you may sometimes need to check which users are currently logged into your system.

This information can be useful for various reasons such as for troubleshooting performance issues, monitoring user activity, or for simply checking who else is using the system.

There are several methods to list current logged-in users on Linux and see what they are doing.

1. The users Command

The users command in Linux lists all users who are currently logged in in alphabetic order.

Note that if a user has two login sessions, it will appear twice in the output.

The output below tells that there are three users logged into the system currently.

2. Using the who Command

The who command prints the list of users currently logged into the system along with other information such as the terminal they’re using, login date and time, and IP address or hostname of the system if a user is on a remote machine.

To list current logged-in users on Linux, use the who command as follows:

You can also use the who command with -a and -H flags to display idle time and PID of the user’s login shell:

3. Using the w Command

The w command in Linux shows logged-in users and their activities. It prints the list of users and their current processes in the command line.

The header in the output summarizes the status of the system which includes the current time, system uptime, number of logged-in users, and load average. Then for each logged-in user, it displays the user name, tty name, time of login, idle time, time used by all the processes (JCPU), time used by the current process (PCPU), and the current process the user is running.

4. Using the last Command

The last command lists current as well as past logged-in and logged-out users. The information it provides includes the name of users and terminals, the IP address of the system they are logged in from, and the date and time of login.

To find the list of users logged in currently, use the last command with the -p now option as follows:

5. The finger Command

The finger command shows information about all the logged-in users on Linux including their username, tty, login date and time, and IP address. You can easily install finger on your Linux distribution using the default package managers.

On Debian-based distributions:

sudo apt-get install finger 

On RHEL-based distributions:

To display information on current logged-in users, run the finger command without any command-line options:

Источник