who
**Example:**
who
root pts/0 2024-11-06 15:56 (10.10.2.11)
root pts/1 2024-11-06 14:23 (10.10.2.11)
Column 1 displays the login name of the user.
Column 2 shows the terminal session device filename (pts stands for pseudo terminal session, and tty identifies a terminal window on the console).
w
**Example:**
w
16:03:46 up 54 days, 20:54, 2 users, load average: 0.00, 0.01, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/0 10.10.2.11 15:56 2.00s 0.00s 0.00s w
root pts/1 10.10.2.11 14:23 1:33m 0.04s 0.04s -bash
The w (what) command displays information in a similar format as the who command, but it also tells the length of time the user has been idle for (IDLE), along with the CPU time used by all processes including any existing background jobs attached to this terminal (JCPU), the CPU time used by the current process (PCPU), and current activity (WHAT).
whoami
last
**Example:**
last
root pts/0 10.10.2.11 Wed Nov 6 15:56 still logged in
root pts/1 10.10.2.11 Wed Nov 6 14:23 still logged in
root pts/0 10.10.2.11 Wed Nov 6 13:25 - 15:36 (02:11)
root pts/4 10.10.2.11 Tue Nov 5 15:14 - 18:16 (03:02)
Column 1: Login name of the user Column 2: Terminal name assigned upon logging in Column 3: Terminal name or IP address from where the connection was established Column 4 to 7: Day, month, date, and time when the connection was established Column 8: Log out time. If the user is still logged on, it will say “still logged in” Column 9: Duration of the login session
id
**Example:**
id omair
uid=502(omair) gid=502(omair) groups=502(omair)
last reboot
**Example:**
last reboot
reboot system boot 3.10.0-1160.119. Thu Sep 12 19:09 - 16:08 (54+20:58)
reboot system boot 3.10.0-1160.119. Wed Sep 11 19:15 - 19:09 (23:54)
reboot system boot 3.10.0-1160.el7. Mon Sep 9 15:02 - 19:14 (2+04:11)
Column 1: Action name (reboot) Column 2: Activity name (system boot) Column 3: Linux kernel version Column 4 to 7: Day, month, date, and time when the reboot command was issued Column 8: System restart time Column 9: Duration the system remained down. If the system is running, it will say “still running”.
lastb
**Example:**
lastb
admin ssh:notty 172.16.28.75 Wed Nov 6 10:17 - 10:17 (00:00)
admin ssh:notty 172.16.28.75 Wed Nov 6 10:17 - 10:17 (00:00)
Column 1: Name of the user who made the login attempt Column 2: Name of the protocol used. No tty was assigned as the attempt failed Column 3: Terminal name or IP address from where the connection attempt was launched Column 4 to 7: Day, month, date, and time of the attempt Column 8: Duration the login attempt was tried Column 9: Duration the login attempt lasted for