who Command

who [OPTION]... [FILE | ARG1 ARG2]

# Show all logged-in users who # Output example: # alice pts/0 2025-01-16 10:30 (192.168.1.100) # bob pts/1 2025-01-16 11:15 (192.168.1.101) # charlie tty1 2025-01-16 09:45 # Show with column headers who -H # Output: # NAME LINE TIME COMMENT # alice pts/0 2025-01-16 10:30 (192.168.1.100) # Quick count of users who -q # Output: alice bob charlie # # users = 3

# Standard output format: # USERNAME TERMINAL LOGIN_TIME (REMOTE_HOST) who # alice pts/0 2025-01-16 10:30 (192.168.1.100) # | | | | # | | | +-- Remote host/IP # | | +-- Login date and time # | +-- Terminal (pts = pseudo-terminal) # +-- Username # Terminal types: # console - Physical console # tty1-6 - Virtual terminals # pts/0-N - Pseudo-terminals (SSH, GUI terminals) # :0 - X11 display (GUI login)

# Show information for current terminal only who -m who am i # These are equivalent and show: # - Current user # - Current terminal # - Login time # - Remote host (if applicable) # Example output: # alice pts/0 2025-01-16 10:30 (192.168.1.100)

# Show all available information who -a # This includes: # - Boot time (-b) # - Dead processes (-d) # - Login processes (-l) # - Init processes (-p) # - Runlevel (-r) # - Time changes (-t) # - Terminal status (-T) # - User processes (-u) # Show with headers for clarity who -aH

# Show user processes with idle time and PID who -u # Output example: # alice pts/0 2025-01-16 10:30 . 1234 (192.168.1.100) # bob pts/1 2025-01-16 11:15 00:05 5678 (192.168.1.101) # | | # | +-- Process ID # +-- Idle time (. = active) # Show terminal write permissions who -T # Output shows +/- for write permission: # + alice pts/0 2025-01-16 10:30 (192.168.1.100) # - bob pts/1 2025-01-16 11:15 (192.168.1.101) # | # +-- + = messages allowed, - = messages blocked

# Show system boot time who -b # Output: system boot 2025-01-16 08:00 # Show current runlevel who -r # Output: run-level 5 2025-01-16 08:01 # Show last system clock change who -t # Output: clock change 2025-01-16 08:00 # Show login processes who -l # Show dead processes who -d

# Monitor for specific user who | grep alice # Check for remote logins who | grep -E '\([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\)' # Count total logged-in users who | wc -l # Find users logged in from specific IP who | grep "192.168.1.100" # Check for console logins who | grep console # Monitor for root logins who | grep root

# Check system uptime via boot time who -b # Monitor user sessions before maintenance echo "Users currently logged in:" who -H echo "Total users: $(who | wc -l)" # Check for idle users who -u | awk '$6 != "." {print $1 " idle for " $6}' # Find long-running sessions who -u | awk 'NR>1 { if ($6 ~ /[0-9]+:[0-9]+/) { split($6, time, ":"); if (time[1] > 1) print $1 " idle for " $6 } }' # Generate user activity report echo "=== User Activity Report ===" echo "Generated: $(date)" echo "System boot: $(who -b | awk '{print $3, $4}')" echo "Current runlevel: $(who -r | awk '{print $2}')" echo who -H

#!/bin/bash # User login monitoring script LOG_FILE="/var/log/user-logins.log" ALERT_EMAIL="[email protected]" # Function to log user activity log_activity() { echo "$(date '+%Y-%m-%d %H:%M:%S') - User Activity:" >> "$LOG_FILE" who >> "$LOG_FILE" echo "---" >> "$LOG_FILE" } # Check for suspicious activity check_security() { # Check for root logins if who | grep -q "^root "; then echo "WARNING: Root user logged in" | mail -s "Security Alert" "$ALERT_EMAIL" fi # Check for unusual login times (outside business hours) current_hour=$(date +%H) if [ $current_hour -lt 8 ] || [ $current_hour -gt 18 ]; then user_count=$(who | wc -l) if [ $user_count -gt 0 ]; then echo "After-hours login detected: $(who)" | mail -s "After Hours Alert" "$ALERT_EMAIL" fi fi # Check for multiple sessions from same user who | awk '{print $1}' | sort | uniq -c | awk '$1 > 3 { print "User " $2 " has " $1 " active sessions" }' | while read alert; do echo "$alert" | mail -s "Multiple Sessions Alert" "$ALERT_EMAIL" done } # Run monitoring log_activity check_security

# who - detailed current login info who # alice pts/0 2025-01-16 10:30 (192.168.1.100) # bob pts/1 2025-01-16 11:15 (192.168.1.101) # w - current activity and load w # 11:30:01 up 3:30, 2 users, load average: 0.15, 0.10, 0.05 # USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT # alice pts/0 192.168.1.100 10:30 0.00s 0.04s 0.00s w # bob pts/1 192.168.1.101 11:15 5:00 0.02s 0.02s vim # users - simple list users # alice bob # last - login history last -n 3 # alice pts/0 192.168.1.100 Wed Jan 16 10:30 still logged in # bob pts/1 192.168.1.101 Wed Jan 16 11:15 still logged in # charlie pts/2 192.168.1.102 Wed Jan 16 09:00 - 10:00 (01:00)

# Extract specific information who | awk '{print $1}' | sort -u # Unique usernames who | awk '{print $2}' | sort # Terminal list who | awk '{print $3, $4}' # Login times # Format output nicely who -H | column -t # Create custom report echo "Current User Sessions:" printf "%-10s %-8s %-16s %s\n" "USER" "TERMINAL" "LOGIN_TIME" "FROM" echo "----------------------------------------" who | while read user term date time from; do printf "%-10s %-8s %-16s %s\n" "$user" "$term" "$date $time" "$from" done # JSON format output who | awk '{ gsub(/[()]/, "", $5); printf "{\"user\":\"%s\",\"terminal\":\"%s\",\"time\":\"%s %s\",\"from\":\"%s\"}\n", $1, $2, $3, $4, $5 }'

# Use different utmp files who /var/log/wtmp # Historical data (if supported) who /var/run/utmp # Current data (default) # Compare current vs historical echo "Current users:" who | wc -l echo "Historical login entries:" last | wc -l # Analyze login patterns last | awk '{print $1}' | sort | uniq -c | sort -nr | head -10 # Find peak usage times last | awk '{print $4}' | cut -c1-2 | sort | uniq -c | sort -nr

# Combine who with system metrics echo "System Status Report" echo "====================" echo "Boot time: $(who -b | awk '{print $3, $4}')" echo "Uptime: $(uptime | awk '{print $3, $4}' | sed 's/,//')" echo "Load: $(uptime | awk '{print $NF}')" echo "Users: $(who | wc -l)" echo echo "Active Sessions:" who -H echo echo "System Resources:" free -h | head -2 df -h / | tail -1 # Monitor user resource usage who | while read user term rest; do if [ -n "$user" ]; then processes=$(ps -u "$user" --no-headers | wc -l) memory=$(ps -u "$user" -o rss --no-headers | awk '{sum+=$1} END {print sum/1024 "MB"}') echo "$user: $processes processes, ${memory:-0MB} memory" fi done