Is it possible to find out who is logged in to the server from command line? Yes, it is possible using a few Linux commands. Let’s explore how to detect user names logged into the Linux server.
3 Commands to Find out who is logged in to the server
w command
w command prints useful information about how many users are logged in inside the server, and what are their running processes. Example:
[[email protected]:~]w 21:36:01 up 274 days, 17:33, 1 user, load average: 0.19, 0.24, 0.29 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ultrauser pts/0 111.111.111.111 20:46 0.00s 0.02s 0.00s sshd: ultrauser [priv] [[email protected]:~]
To see more information about a certain user, you can run this command:
w user
Where user is the username. Example:
[webtech@localhost ~]$ w webtech 23:39:16 up 54 min, 1 user, load average: 0,48, 0,48, 0,41 USER TTY LOGIN@ IDLE JCPU PCPU WHAT webtech tty2 22:45 54:28 14:38 2.52s /opt/google/chrome/chrome --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCr [webtech@localhost ~]$
who command
who command is another command that can help to find out who is logged in to the server.
Output example:
[[email protected]:~]who ultrauser pts/0 2017-01-29 20:46 (111.111.111.111) [[email protected]:~]
You can also use -a option to print out all the full information. Output example:
[[email protected]:~]who -a system boot 2016-04-30 05:03 run-level 3 2016-04-30 05:03 LOGIN tty1 2016-04-30 05:03 7200 id=1 LOGIN tty2 2016-04-30 05:03 7202 id=2 LOGIN tty3 2016-04-30 05:03 7204 id=3 LOGIN tty4 2016-04-30 05:03 7206 id=4 LOGIN tty5 2016-04-30 05:03 7208 id=5 LOGIN tty6 2016-04-30 05:03 7210 id=6 ultrauser + pts/0 2017-01-29 20:46 . 13648 (111.111.111.111) pts/1 2017-01-27 08:45 24158 id=ts/1 term=0 exit=0 pts/2 2016-09-16 15:08 32364 id=ts/2 term=0 exit=0 pts/3 2017-01-04 17:09 15024 id=ts/3 term=0 exit=0 pts/2 2016-07-22 08:45 22855 id=/2 term=0 exit=0 pts/1 2016-10-03 16:41 25856 id=/1 term=0 exit=0 pts/4 2017-01-03 16:52 25470 id=ts/4 term=0 exit=0 pts/5 2017-01-03 13:31 26228 id=ts/5 term=0 exit=0 [[email protected]:~]
There many options to pass to the who command:
-a, --all same as -b -d --login -p -r -t -T -u -b, --boot time of last system boot -d, --dead print dead processes -H, --heading print line of column headings -l, --login print system login processes --lookup attempt to canonicalize hostnames via DNS -m only hostname and user associated with stdin -p, --process print active processes spawned by init -q, --count all login names and number of users logged on -r, --runlevel print current runlevel -s, --short print only name, line, and time (default) -t, --time print last system clock change -T, -w, --mesg add user's message status as +, - or ? -u, --users list users logged in --message same as -T --writable same as -T --help display this help and exit --version output version information and exit
users command
users command prints the login names of the users that are currently logged into the system, but ordered and on a single line. users command reads information from utmp file.
Output example:
[[email protected]:~]users ultrauser johndoe linuxuser2 alterego34
As you see, the ‘users’ command is very basic and you can not get too much information.
Finger Command
While finger command is not a command to find out who is logged in to the server, it can help you to retrieve user information if you need to know more details.
Output example:
[[email protected]:~]finger ultrauser Login: ultrauser Name: John Bonachon Directory: /home/ultrauser Shell: /bin/bash On since Sun Jan 29 20:46 (EST) on pts/0 from 111.111.111.111 No mail. No Plan.
As you see, using finger command can help you to find out more information like type of shell used, home directory, real name, login username, and last time it was seen online.
References: