Commands to get the list of logged in users in Linux

[DaMysterious]

Method 1

last command will give login history for a specific username. If we don’t give any argument for this command, it will list login history for all users. By default this information will read from /var/log/wtmp file. The output of this command contains the following columns:

• User name
• Tty device number
• Login date and time
• Logout time
• Total working time

 ​​​​​
# last -a

deepak   pts/3        Tue Oct 16 18:01 - 18:01  (00:00)     10.10.10.30
root     pts/2        Tue Oct 16 17:51   still logged in    10.10.10.30
root     pts/1        Tue Oct 16 14:29 - 18:03  (03:34)     10.10.10.30
root     pts/3        Tue Oct 16 11:10 - 13:11  (02:00)     10.10.10.30
root     pts/1        Mon Oct 15 20:30 - 13:21  (16:51)     10.10.10.30
root     pts/3        Mon Oct 15 18:02 - 18:37  (00:34)     10.10.10.30
root     pts/1        Mon Oct 15 15:23 - 18:34  (03:11)     10.10.10.30
root     pts/1        Mon Oct 15 10:45 - 15:22  (04:36)     10.10.10.30
root     pts/2        Fri Oct 12 18:34 - 15:53 (3+21:19)    :2.0
root     pts/1        Fri Oct 12 18:07 - 19:34  (01:27)     10.10.10.30
root     pts/0        Fri Oct 12 17:57   still logged in    :0.0
root     tty1         Fri Oct 12 17:56   still logged in    :0
reboot   system boot  Fri Oct 12 17:44 - 18:03 (4+00:19)    2.6.32-220.el6.i686

Method 2

w command is used to show logged-in user names and what they are doing. The information will be read from /var/run/utmp file. The output of the w command contains the following columns:

• Name of the user
• User’s machine number or tty number
• Remote machine address
• User’s Login time
• Idle time (not usable time)
• Time used by all processes attached to the tty (JCPU time)
• Time used by the current process (PCPU time)
• Command currently getting executed by the users

Following options can be used for the w command:

• -h Ignore the header information
• -u Display the load average (uptime output)
• -s Remove the JCPU, PCPU, and login time.

$ w
 23:04:27 up 29 days,  7:51,  3 users,  load average: 0.04, 0.06, 0.02
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
ramesh   pts/0    dev-db-server        22:57    8.00s  0.05s  0.01s sshd: ramesh [priv]
jason    pts/1    dev-db-server        23:01    2:53   0.01s  0.01s -bash
john     pts/2    dev-db-server        23:04    0.00s  0.00s  0.00s w

$ w -h
ramesh   pts/0    dev-db-server        22:57   17:43   2.52s  0.01s sshd: ramesh [priv]
jason    pts/1    dev-db-server        23:01   20:28   0.01s  0.01s -bash
john     pts/2    dev-db-server        23:04    0.00s  0.03s  0.00s w -h

$ w -u
 23:22:06 up 29 days,  8:08,  3 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
ramesh   pts/0    dev-db-server        22:57   17:47   2.52s  2.49s top
jason    pts/1    dev-db-server        23:01   20:32   0.01s  0.01s -bash
john     pts/2    dev-db-server        23:04    0.00s  0.03s  0.00s w -u

$ w -s
 23:22:10 up 29 days,  8:08,  3 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM               IDLE WHAT
ramesh   pts/0    dev-db-server        17:51  sshd: ramesh [priv]
jason    pts/1    dev-db-server        20:36  -bash
john     pts/2    dev-db-server         1.00s w -s

Method 3

who: This command shows currently logged in users with time details

# who -u
root     tty1         2012-10-12 17:56  old         1960 (:0)
root     pts/0        2012-10-12 17:57 06:51        2376 (:0.0)
root     pts/1        2012-10-16 14:29 02:09        3094  (10.10.10.30)
root     pts/2        2012-10-16 17:51   .          3454 (10.10.10.30)

To get a list of all usernames that are currently logged in, use the following:

 
 $ [B]who | cut -d' ' -f1 | sort | uniq[/B] john jason ramesh