Sorry my knowledge of Linux bash commands is pretty basic, I've been searching for a while but I'm not 100% sure what I need to search for.

I was wondering if there's a way to grab the current logged in users remote host name in a Linux bash script? I have a script in which I need to log each time a user runs it. I'm obtaining the date like so:

cdat=`/bin/date +%a' '%d' '%h' '%Y', '%H':'%M`;

I now need to add the users remote host (not the username they logged in with). I'm not 100% sure I'm using the right terminology here either, just to clarify; by 'remote host name' I mean the same output that prints on the screen on most servers I've logged into over ssh, for example:

Last login: Mon Jul 22 16:35:09 2013 from win7-i7-stuart.my.domain.com

I'm looking for the win7-i7-stuart.my.domain.com bit.

  • hit set to see environment, maybe $SSH_CLIENT is what you need? – F. Hauri Jul 22 '13 at 17:22

Better to use the command who am i so that you don't get the duplicate info and have to parse it when using just a plain who.

$ who am i
sam      pts/6        2013-07-22 13:21 (

Humourously you can also use this:

$ who mom likes
sam      pts/6        2013-07-22 13:21 (

You can parse it using sed so that it's just the host they're connecting from:

$ who am i | sed 's/.*(\(.*\))/\1/'

You can also see the entire history of a user's logins using the last command:

$ last <username>

For example:

$ last sam | less
sam      pts/6    Mon Jul 22 13:21   still logged in   
sam      pts/6    Mon Jul 22 11:02 - 11:02  (00:00)    
sam      pts/5    Thu Jul 18 14:41 - 16:41  (01:59)    
sam      pts/5    Wed Jul 17 15:56 - 16:28  (00:31)    
sam      pts/5    Wed Jul 17 15:56 - 15:56  (00:00)    
sam      pts/4    Wed Jul 17 14:28 - 14:29  (00:00)    
sam      pts/7    Tue Jul 16 16:27 - 16:50  (00:23)


  • You can also use who a a, or better yet, who -m, which is what is implied by having any two arguments. – Paulo Almeida Jul 22 '13 at 17:35
  • @PauloAlmeida - good to know. Thanks for the extra details. – slm Jul 22 '13 at 17:40
  • Perfect, this works a treat, thanks for the reading material too :) – Stu Jul 23 '13 at 7:32
jmcnama    pts/4        Jul 18 13:30    (9010-b6m2cx1.nmgco.com)

The last field of the who output provides:

remote=$(who | awk -v user=$username '$1 == user {print $(NF)}')

There can be other problems, like the user is logged on multiple times. The last command can help as well. last has problem - it can truncate long source node values.

As far as I know there is no /proc "file" that shows the origin of the login. Last and who data are stored in /var//log/wtmp (usually). So this is the only file source for this information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.