I want to know how the user logged in( Using RDP, ssh, VNC, or any kind of...). How can I log a general way that is independent of Linux OS shows the type of user's login?

  • Have you looked at logs where login attempts (successful and unsuccessful) are logged? How is authentication handled on your system? What Linux system are you using and what VNC server etc. are you running?
    – Kusalananda
    Sep 6, 2022 at 10:42

1 Answer 1


lsof is a command line tool to determine which files are being used by users and as everything is a file in Linux this can be used to see which users are using "ssh" or "xvnc" (which means how they are connected to the server.

here is the CLI code for ssh:

% sudo lsof -i -n | egrep '\<ssh\>'
ssh  19749  user  3u  IPv4 148088244   TCP x.x.x.x:39689->y.y.y.y:22 (ESTABLISHED)
ssh  19749  user  4u  IPv6 148088282   TCP [::1]:9090 (LISTEN)
ssh  19749  user  5u  IPv4 148088283   TCP (LISTEN)

for vnc/rdp connections these commands can be used:

$ sudo lsof  -b -w -n -c /^Xvnc$/b -a -iTCP:5900-5999 
Xvnc    1625 guest    1u  IPv4 252910      0t0  TCP (LISTEN)
Xvnc    1625 guest    9u  IPv4 261226      0t0  TCP> (ESTABLISHED)

take a look at Detecting a disconnected RDP session in a unix system

  • Thanks, but it has some problems, first of all for RDP it just returns the user that listens to the RDP port, not the user that logged in to the server for example in my case it returns xrdp and I want to know who connected immediately that it does not do this. Sep 6, 2022 at 7:35
  • will ps command help? use ps -ef | grep Xorg for rdp and ps -ef | grep xvnc for vnc
    – Amirreza
    Sep 6, 2022 at 7:58
  • As I said it just shows when calling it. but I want to be aware of when users connected, like fire events. Sep 6, 2022 at 8:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .