Linux/Unix – User Activity
The recipes in this section describe some of the simple commands for finding out who you are currently sharing the system with and what they are doing.
Listing Your Username
Use whoami to output the username of the user that is logged in at your terminal. This is not as inutile a command as one might first think−−if you’re at a shared terminal, it’s useful to determine whether or not it is your account that you’re messing in, and for those with multiple accounts on a system, it’s useful to see which of them you’re currently logged in with.
To output your username, type:
In this example, the username of the user logged in at this terminal is `mgsotoso’.
Listing Who Is on the System
Use who to output a list of all the users currently logged in to the system. It outputs a minimum of three columns, listing the username, terminal location, and time of login for all users on the system. A fourth column is displayed if a user is using the X Window System; it lists the window location of the user’s session.
To see who is currently logged in, type:
murky tty1 Oct 20 20:09
dave tty2 Oct 21 14:37
mgsotoso tty3 Oct 21 15:04
mgsotoso ttyp1 Oct 21 15:04 (:0.0)
The output in this example shows that the user murky is logged in on tty1 (the first virtual console on the system), and has been on since 20:09 on 20 October. The user dave is logged in on tty2 (the second virtual console), and has been on since 14:37 on 21 October. The user mgsotoso is logged in twice−−on tty3 (the third virtual console), and ttyp1, which is an X session with a window location of `(:0.0)’.
NOTE: This command is for listing the users on the local system; to list the users connected to a different system on the network, or to see more detailed information that a user may have made public about himself.
Listing Who Is on and What They’re Doing
The w tool is similar to who, but it displays more detail. It outputs a header line that contains information about the current system status, including the current time, the amount of time the system has been up and running, and the number of users on the system. It then outputs a list of users currently logged in to the system, giving eight columns of information for each. These columns include username, terminal location, X session (if any), the time of login, the amount of time the user has been idle, and what command the user is running. (It also gives two columns showing the amount of time the system’s CPU has spent on all of the user’s current jobs (“JCPU”) and foreground process (“PCPU”).
To see who is currently logged in and what they are doing, type:
5:27pm up 17:53, 4 users, load average: 0.12, 0.06, 0.01
USER TTY FROM LOGIN IDLE JCPU PCPU WHAT
murky tty1 Oct 20 20:09 17:22m 0.32s 0.32s −bash
dave tty2 14:37 13.00s 2:35 0.07s less foo
mgsotoso tty3 15:04 1:00m 0.41s 0.09s startx
mgsotoso ttyp1 :0.0 15:04 0:00s 21.65s 20.96s emacs
In this example, the command’s output shows that the current system time is 5:27 p.m., the system has been up for 17 hours and 53 minutes, and there are four users currently logged in: murky is logged in at tty1, has been idle for 17 hours and 22 minutes, and is at a bash shell prompt; dave is logged in at tty2, has been idle for 13 seconds, and is using less to peruse a file called `foo’; and mgsotoso is logged in at two terminals−−−tty3 and ttyp1, which is an X session. He ran the startx command on tty3 to start his X session, and within his X session, he is currently using Emacs.
Listing the Last Times a User Logged In
Use last to find out who has recently used the system, which terminals they used, and when they logged in and out.
To output a list of recent system use, type:
To find out when a particular user last logged in to the system, give his username as an argument. To find out when user mgsotoso last logged in, type:
$ last mgsotoso
NOTE: The last tool gets its data from the system file `/var/log/wtmp’; the last line of output tells how far this file goes back. Sometimes, the output will go back for several weeks or more.