On a typical Linux system, there are numerous programs for finding out who is logged on, and what they are doing. Among these are who, w, and finger.
Example 8-6. Finding out who is logged on
$ who thammond pts/0 May 28 10:14 (vh225002.truman.edu) agarvey pts/1 May 30 11:44 (vh216601.truman.edu) hammond vh225002.truman.edu:1 Jun 5 17:23 thammond pts/3 May 28 12:26 (vh225002.truman.edu) dbindner pts/7 Jun 11 13:13 (modem65.ipv6.truman.edu) hammond pts/9 Jun 11 11:08 (vh225002.truman.edu) $ w 13:14:20 up 14 days, 19:31, 6 users, load average: 2.07, 2.00, 1.98 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT thammond pts/0 vh225002.truman. 28May03 2:06m 0.33s 0.33s -bash agarvey pts/1 vh216601.truman. 30May03 9days 6.51s 6.51s -bash hammond vh225002 - Thu17 0.00s 13days 0.13s sshd thammond pts/3 vh225002.truman. 28May03 2:06m 0.55s 0.55s -bash dbindner pts/7 modem65.ipv6.tru 13:13 0.00s 0.03s 0.02s w hammond pts/9 vh225002.truman. 11:08 1:58m 0.01s 0.01s -bash $ finger Login Name Tty Idle Login Time Office Office Phone agarvey Alan Garvey pts/1 9d May 30 11:44 (vh216601.truman.edu) dbindner Donald J Bindner pts/7 Jun 11 13:13 (modem65.ipv6.truman.edu) hammond Todd Hammond *vh22500 Jun 5 17:23 hammond Todd Hammond pts/9 1:59 Jun 11 11:08 (vh225002.truman.edu) thammond Todd Hammond pts/0 2:07 May 28 10:14 (vh225002.truman.edu) thammond Todd Hammond pts/3 2:06 May 28 12:26 (vh225002.truman.edu)
The who, w, and finger commands return many of the same pieces of information, including the account name, the amount of idle time (i.e. how long since a key has been typed), and where the person is logged in from. Which of the commands you choose to use is mostly a matter of preference.
If you need to know who has been on recently, rather than than who is
on at the moment, the last command can list that.
It takes a single argument
-n where n indicates you would like a listing of the
n most recent logins.
Example 8-7. Using the last command
$ last -10 dknudson pts/8 0-1pool245-222.n Wed Jun 11 13:14 - 13:14 (00:00) dbindner pts/7 modem65.ipv6.tru Wed Jun 11 13:13 - 13:24 (00:10) dgarth vh222005.tru Wed Jun 11 12:23 - 12:26 (00:02) dknudson pts/7 0-1pool245-222.n Wed Jun 11 12:20 - 12:46 (00:25) hammond vh222005.tru Wed Jun 11 11:53 - 12:14 (00:21) cmj489 pts/7 :0.0 Wed Jun 11 11:34 - 11:35 (00:00) cmj489 :0 Wed Jun 11 11:34 - 11:35 (00:00) hammond vh222005.tru Wed Jun 11 11:09 - 11:15 (00:05) hammond pts/9 vh225002.truman. Wed Jun 11 11:08 still logged in cmj489 pts/9 :0.0 Wed Jun 11 09:41 - 09:41 (00:00) wtmp begins Sun Jun 1 18:51:35 2003
There are some situations where you would like more specific information about a particular account. For example, you may have happened across a terminal where the previous user has forgotten to logout. You can identify the user easily with who:
Perhaps you have found a file belonging to an account (say dbindner), or noticed that a particular user is using a lot of processor time. The finger command can conveniently place a name to the account. It can also tell you if that person has new email waiting for them on the system, or the last time they read it. Some systems can be fingered remotely as well, using a user@host syntax.
Example 8-9. Fingering a single account
$ finger dbindner Login: dbindner Name: Donald J Bindner Directory: /home/ldap/dbindner Shell: /bin/bash Office: Violette Hall 2244, 785-4258 On since Wed Jun 11 13:13 (CDT) on pts/7 from modem65.ipv6.truman.edu No mail. No Plan. $ finger dbindner@limestone [limestone.truman.edu] Login: dbindner Name: Donald J Bindner Directory: /home/dbindner Shell: /bin/bash Office: 2244 Violette Hall, 785-4258 On since Tue May 13 10:41 (CDT) on tty1 29 days 2 hours idle (messages off) Last login Wed Jun 11 12:15 (CDT) on pts/1 from modem65.ipv6.truman.edu Mail last read Wed Jun 11 13:07 2003 (CDT) Plan: Public key: http://limestone.truman.edu/~dbindner/public.txt Key fingerprint = 95B9 6D7A 3457 E0C7 4636 A9F9 2EE7 86CE 1B23 F31F
On some systems, the finger command has been disabled, but often much of the same information can be obtained from the /etc/passwd file using grep. For example: