1

This question already has an answer here:

I am accessing a Unix server using SSH client from my Windows machine (M/C name: MyComp). I have logged in as user id: MyID.

Is there any way I can determine what are the active session in Unix?

e.g something like "someone from Mycomp Logged in at xx:xx using MyID"

marked as duplicate by Chris Down, Anthon, jasonwryan, manatwork, slm Jul 10 '13 at 7:15

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Like who -a...? – jasonwryan Jul 10 '13 at 1:46
2

last and who are what you want.

who

This prints information about the users that are currently logged in. It gives output like:

18:43:37 jake@localhost]~% who
jake     tty1         2013-07-09 13:00
jake     tty2         2013-07-09 13:00
18:48:13 jake@localhost]~% sudo su
[sudo] password for jake: 
[root@localhost jake]# who
jake     tty1         2013-07-09 13:00
jake     tty2         2013-07-09 13:00

last

From man last:

Last searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created.

It gives output like:

18:43:33 jake@localhost]~% last | tac
wtmp begins Tue Jul  9 09:47:29 2013

reboot   system boot  3.9.5-301.fc19.x Tue Jul  9 09:47 - 10:44  (00:57)    
(unknown :0           :0               Tue Jul  9 09:47 - 10:15  (00:27)    
root     tty2                          Tue Jul  9 09:48 - down   (00:56)    
root     tty3                          Tue Jul  9 09:55 - down   (00:49)    
root     tty4                          Tue Jul  9 09:58 - 10:05  (00:07)    
jake     tty4                          Tue Jul  9 10:05 - down   (00:39)    
(unknown :1           :1               Tue Jul  9 10:15 - 10:15  (00:00)    
jake     :1           :1               Tue Jul  9 10:15 - 10:44  (00:29)    
jake     pts/0        :1               Tue Jul  9 10:38 - 10:44  (00:06)    
reboot   system boot  3.9.9-301.fc19.x Tue Jul  9 10:45 - 12:43  (01:58)    
jake     tty1                          Tue Jul  9 10:45 - 10:49  (00:03)    
jake     tty2                          Tue Jul  9 10:47 - 10:51  (00:04)    
jake     tty3                          Tue Jul  9 10:47 - 10:51  (00:03)    
jake     tty1                          Tue Jul  9 10:49 - 10:51  (00:02)    
jake     tty3                          Tue Jul  9 12:17 - down   (00:26)    
jake     tty2                          Tue Jul  9 12:26 - 12:27  (00:01)    
root     tty1                          Tue Jul  9 12:26 - down   (00:16)    
jake     tty2                          Tue Jul  9 12:27 - down   (00:16)    
root     pts/0        :0               Tue Jul  9 12:40 - 12:43  (00:02)    
reboot   system boot  3.9.9-301.fc19.x Tue Jul  9 12:46 - 12:59  (00:12)    
jake     tty1                          Tue Jul  9 12:47 - 12:49  (00:02)    
jake     tty2                          Tue Jul  9 12:47 - 12:49  (00:02)    
jake     tty1                          Tue Jul  9 12:49 - down   (00:10)    
jake     tty2                          Tue Jul  9 12:49 - down   (00:09)    
root     tty3                          Tue Jul  9 12:50 - down   (00:08)    
reboot   system boot  3.9.9-301.fc19.x Tue Jul  9 13:00 - 18:43  (05:43)    
jake     tty1                          Tue Jul  9 13:00   still logged in   
jake     tty2                          Tue Jul  9 13:00   still logged in   
jake     pts/25       :0               Tue Jul  9 15:39 - 15:39  (00:00)    
jake     pts/4        :0               Tue Jul  9 18:11 - 18:11  (00:00)    

You see I piped the output through tac, because I like seeing the newest entry at the end of the list.

1

The who command shows you who is connected to what terminals and from where.

The command who /var/log/wtmp will give you a historical listing of who had logged in.

Not the answer you're looking for? Browse other questions tagged or ask your own question.