How you can assess person exercise in Linux

On this submit, we have a look at instructions that Linux server admins can use to view person exercise

man looking up linux code command for user assessment by electravk getty images

electravk / Getty Pictures

If you happen to’re managing a Linux server, it’s good to be prepared with quite a few instructions that you should utilize to examine person exercise – when your customers are logging in and the way usually, what teams they belong to, how a lot disk house they’re consuming, what command they’re working, how a lot disk house they’re occupying, in the event that they’re studying their mail and extra.

On this submit, we’ll have a look at quite a few instructions that may enable you to perceive who your person are and the way they work.


One useful command for getting a person profile is finger. It permits you to see who’s logged in or concentrate on a single person to view their final login, the place they logged in from, how lengthy they have been idle (how lengthy since they ran a command), and so forth. On this command, we’re wanting on the person nemo.

$ finger nemo
Login: nemo Identify: Nemo Demo
Listing: /dwelling/nemo Shell: /bin/bash
On since Fri Jun 19 12:58 (EDT) on pts/1 from
7 minutes 47 seconds idle
New mail obtained Wed Jun 17 18:31 2020 (EDT)
Unread since Sat Jun 13 18:03 2020 (EDT)
No Plan.

We will see nemo’s full identify, dwelling listing and shell. We will additionally see nemo’s most up-to-date login and e-mail exercise. Workplace, workplace cellphone and residential cellphone numbers are solely included if they’re outlined within the /and so forth/passwd file within the full identify area. For instance:

nemo:x:1001:1001:Nemo Demo,11,540-222-2222,540-333-3333:/dwelling/nemo:/bin/bash).

The output above additionally signifies that nemo would not have a “plan”, however this simply signifies that he hasn’t created a .plan file and put some textual content into it; this isn’t in any respect uncommon.

With out arguments, finger will show a listing of present logins within the format proven under. You may see once they logged in, the IP deal with they logged in from, the pseudo terminal in use (e.g., pts/1) and the way lengthy they have been idle.

$ finger
Login Identify Tty Idle Login Time Workplace Workplace Telephone
nemo Nemo Demo pts/1 1:24 Jun 19 12:58 (
shs Sandra Henry-Stocker pts/Zero Jun 19 12:57 (


The w command additionally offers a properly formatted checklist of at the moment lively customers together with idle time and what command they most not too long ago ran. It additionally shows within the high line how lengthy the system has been up and offers load averages that point out how busy the system is. On this case (0.00 for final 1, 5 and 15 minutes), the system is essentially idle.

$ w
14:23:19 up 1 day, 20:24, 2 customers, load common: 0.00, 0.00, 0.00
shs pts/0 12:57 0.00s 0.14s 0.01s w
nemo pts/1 12:58 1:24m 0.03s 0.03s -bash


With the id command, you’ll be able to view a person’s numeric ID and group ID together with what teams the person is a member of. This info is pulled from the /and so forth/passwd and /and so forth/group information. With no arguments, id reviews the knowledge to your account.

$ id
uid=1000(shs) gid=1000(shs) teams=1000(shs),4(adm),11(admin),24(cdrom),27(sudo),30(dip),46(plugdev),118(lpadmin),128(sambashare),500(devops)
$ id nemo
uid=1001(nemo) gid=1001(nemo) teams=1001(nemo),16(fish)


You may yank info from the /var/log/auth.log file with instructions like grep. To point out the latest login exercise utilizing auth.log information, you’ll be able to run a command like this one:

$ grep “New session” /var/log/auth.log | awk ” | tail -5
Jun 17 17:22:38 shs.
Jun 17 17:58:43 gdm.
Jun 17 18:09:58 shs.
Jun 19 12:57:36 shs.
Jun 19 12:58:44 nemo.


The final command might be one of the best for current logins for all customers or one particular person. Simply keep in mind that final reveals the latest exercise first since that is the knowledge that almost all admins are most concerned with.

$ final | head -5
nemo pts/1 Fri Jun 19 12:58 nonetheless logged in
shs pts/0 Fri Jun 19 12:57 nonetheless logged in
shs pts/0 Wed Jun 17 18:10 – 18:42 (00:32)
reboot system boot 5.4.0-37-generic Wed Jun 17 17:58 nonetheless working
shs pts/2 Wed Jun 17 17:22 – 17:57 (00:34)

$ final nemo | head -5
nemo pts/1 Fri Jun 19 12:58 – 16:21 (03:22)
nemo pts/2 Sat Jun 13 17:49 – 19:05 (01:16)
nemo pts/1 Thu Jun 4 17:33 – 17:44 (00:10)
nemo pts/1 Mon Could 11 19:04 – 19:57 (00:52)
nemo pts/1 Tue Could 5 12:46 – 17:49 (05:02)


The du command will report how a lot house every person’s dwelling listing is utilizing if run towards every listing in /dwelling like this:

$ sudo du -sk /dwelling/*
289 /dwelling/dorothy
116 /dwelling/dory
88 /dwelling/eel
28 /dwelling/gino
28 /dwelling/jadep
12764 /dwelling/nemo
732 /dwelling/shark
418046 /dwelling/shs
108 /dwelling/tadpole

By default, the sizes are reported in models of 1024 bytes.

ps and historical past

For at the moment logged in customers, you’ll be able to all the time use instructions like ps -ef | grep ^nemo to see what instructions and processes a person is at the moment working. To view instructions beforehand run, you’ll be able to strive wanting into customers’ historical past information (e.g., .bash_history), however observe that customers can arrange their accounts in order that sure instructions will not be captured of their historical past information, they usually can also edit these information in the event that they so select.

counting logins

If you need to view what number of occasions every of your customers has logged in for the reason that /var/log/wtmp file final rolled over, you should utilize a command like this one:

$ for USER in `ls /dwelling`
> do
> cnt=`final $USER | grep ^$USER | wc -l` # depend logins
> echo $USER: $cnt # present login depend
> accomplished

The output will look one thing like this:

dorothy: 0
dory: 0
eel: 8
gino: 0
jadep: 102
nemo: 39
shark: 50
shs: 105
tadpole: 0

If you need extra element, you’ll be able to put a extra complicated script collectively that may add some further info like login particulars and formatting.



for USER in `ls /dwelling`
len=`echo $USER | awk ”` # get size of username
echo $USER
sep=”$” # set separator
echo $sep # print separator
cnt=`final $USER | grep ^$USER | wc -l` # depend logins
echo logins: $cnt # present login depend
final $USER | grep ^$USER | head -5 # present most up-to-date logins

The script above is limiting the information proven to the latest 5 logins, however you’ll be able to simply change that in case you like. Here is how the information for one person could be formatted:

logins: 105
shs pts/0 Fri Jun 19 12:57 nonetheless logged in
shs pts/0 Wed Jun 17 18:10 – 18:42 (00:32)
shs pts/2 Wed Jun 17 17:22 – 17:57 (00:34)
shs pts/0 Wed Jun 17 17:20 – 17:57 (00:36)
shs pts/1 Wed Jun 17 15:19 – 17:57 (02:38)

checking for sudo makes an attempt

If you would like to see if any of your customers try to make use of sudo when they aren’t set as much as have this privilege, you’ll be able to run a command like this:

$ grep “NOT in sudoers” /var/log/auth.log | awk ”

If you happen to’ve ever tried to make use of sudo in a state of affairs the place you are not licensed to raise your privileges and had the system threaten you with “username will not be within the sudoers file. This incident might be reported,” you may take pleasure in realizing that this log entry is the essence of that report. Until the admin makes an effort to search for sudo transgressions, they may go unnoticed.


There are quite a lot of instructions on Linux techniques that may enable you to examine on person exercise. I hope that a few of these introduced on this submit will show helpful.

Be part of the Community World communities on




to touch upon subjects which can be high of thoughts.

Sandra Henry-Stocker has been administering Unix techniques for greater than 30 years. She describes herself as “USL” (Unix as a second language) however remembers sufficient English to jot down books and purchase groceries. She lives within the mountains in Virginia the place, when not working with or writing about Unix, she’s chasing the bears away from her hen feeders.

Copyright © 2020 IDG Communications, Inc.


Germany Devoted Server

Leave a Reply