There are quite a few ways on Linux to get a list of the users logged into the system and see what they are doing. The commands described in this article all provide very useful information.
users
The users command displays a simple list of logged-in users. In this example, one user is logged in twice and is, therefore, listed twice.
$ users nemo popeye shs shs
Note that the users are listed in alphabetical order.
who
The who command provides additional information. The login terminal is identified along with the login date and time. The final field displays the terminal or the IP address of the connecting system.
$ who shs tty2 2022-11-12 10:54 (tty2) nemo pts/0 2022-11-15 11:07 (192.168.0.3) shs pts/5 2022-11-15 10:41 (192.168.0.3) popeye pts/2 2022-11-15 11:12 (192.168.0.3)
w
The w command provides even more information on logged-in users. The first line of output shows the current time, how long the system has been up, the number of logged-in users, and the 1-, 5- and 15-minute load averages. This information will give you a quick view of how busy the system is.
The lines following the column headings show usernames, login times, how long the sessions have been idle, the time used by all processes associated with the user’s tty (JCPU), the time used by the current process for the user’s terminal (PCPU), and the command being run. If the session is currently idle, you will simply see the shell that is in use (e.g., -bash).
The w command provides a quick view of how heavily the system is being used and where most of the activity is coming from.
$ w 12:16:09 up 3 days, 15:10, 4 users, load average: 0.00, 0.01, 0.01 USER TTY LOGIN@ IDLE JCPU PCPU WHAT shs tty2 Sat13 3days 0.05s 0.05s /usr/libexec/gnome-session-bina nemo pts/0 11:07 4:38 0.04s 0.04s -bash shs pts/5 10:41 0.00s 0.10s 0.00s w popeye pts/2 11:12 1:02m 0.02s 0.02s -bash
last
The last command displays a list of user logins with the most recent logins first. To see the most recent logins, you can use a command like this one:
$ last | head -3 popeye pts/2 192.168.0.3 Tue Nov 15 11:12 still logged in nemo pts/0 192.168.0.3 Tue Nov 15 11:07 still logged in shs pts/5 192.168.0.3 Tue Nov 15 10:41 still logged in
To see how far the currently available login information reaches back, pipe the last command’s output to the tail command.
$ last | tail -3 reboot system boot 5.14.10-300.fc35 Mon Jun 6 15:57 - 16:55 (00:58) wtmp begins Mon Jun 6 15:57:30 2022
ps
A ps command like the one below will provide a list of the processes a user is running. Adding the grep -v `whoami` simply omits the command you would be running to create the list. You can just grep with your username (e.g., grep -v shs), but the command shown works for anyone.
$ ps -ef | grep nemo | grep -v `whoami` root 124982 787 0 11:07 ? 00:00:00 sshd: nemo [priv] nemo 124990 1 0 11:07 ? 00:00:00 /usr/lib/systemd/systemd --user nemo 124999 124990 0 11:07 ? 00:00:00 (sd-pam) nemo 125018 124982 0 11:07 ? 00:00:00 sshd: nemo@pts/0 nemo 125025 125018 0 11:07 pts/0 00:00:00 -bash
By using grep to select process details by the first field, you will see only that user’s processes. The ^nemo argument selects only the output lines that begin with “nemo”.
$ ps -ef | grep ^nemo nemo 124990 1 0 11:07 ? 00:00:00 /usr/lib/systemd/systemd --user nemo 124999 124990 0 11:07 ? 00:00:00 (sd-pam) nemo 125018 124982 0 11:07 ? 00:00:00 sshd: nemo@pts/0 nemo 125025 125018 0 11:07 pts/0 00:00:00 -bash
id
You can use the id command to display some additional details on a user. This includes the user’s UID (user id), GID (group id), and a list of the groups that the user is a member of.
$ id nemo uid=1012(nemo) gid=1012(nemo) groups=1012(nemo),900(techs)
finger
You can also get some information on users with the finger command.
$ finger nemo Login: nemo Name: Nemo the Fish Directory: /home/nemo Shell: /bin/bash On since Tue Nov 15 11:07 (EST) on pts/0 from 192.168.0.3 1 minute 44 seconds idle No mail. No Plan.
uptime
The uptime command will tell you how long the system has been up since its last reboot and the number of user currently logged in. Like the w command, it also provides the system load averages.
$ uptime 12:07:47 up 3 days, 15:01, 4 users, load average: 0.07, 0.13, 0.06
top and htop
If you want to see whether a particular user’s processes are having an impact on system performance, you can use a tool like top or htop to determine whether any user processes are making significant use of system resources. Using either of these tools, pressing the Shift+M keys will sort the output by memory usage. Using Shift+P will sort the output by processor usage. The example below shows nemo as a significant user of the system CPU and memory, but the system is not highly impacted.
top - 12:41:48 up 3 days, 15:35, 4 users, load average: 0.14, 0.06, 0.02 Tasks: 262 total, 1 running, 261 sleeping, 0 stopped, 0 zombie %Cpu(s): 0.8 us, 0.5 sy, 0.0 ni, 98.5 id, 0.2 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 5926.3 total, 145.1 free, 2273.7 used, 3507.5 buff/cache MiB Swap: 5926.0 total, 5926.0 free, 0.0 used. 3374.3 avail Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 3059 root 20 0 259104 29984 8428 S 1.7 0.5 11:11.01 sssd_kcm 134122 nemo 20 0 222648 3976 3524 R 1.3 0.2 0:00.07 loop <=== 128996 shs 20 0 225824 4436 3564 R 0.3 0.1 0:00.63 top 1 root 20 0 172392 17720 11256 S 0.0 0.3 0:03.51 systemd …
Wrap-up
Commands for viewing logged-in users, the processes they are running and how they might impact performance will come in handy whether you are trying to get an understanding of how a Linux system is being used or looking to find the source of a performance problem.
