Linux systems provide many ways to view user activity, including when they login, how long they stay logged in, and what commands they run.
This post examines a number of commands that can help you view and understand user logins and the time users spend on your Linux servers.
The who command
The who command is a basic command that will show you who is logged into your server now. But that’s not all. You will also see when they logged in and where they have logged in from (i.e., the IP address). This example shows two users are logged in from different systems.
$ who fedora seat0 2024-09-13 15:18 (login screen) fedora tty2 2024-09-13 15:18 (tty2) shs pts/1 2024-09-13 15:23 (192.168.0.7) nemo pts/2 2024-09-13 11:11 (192.168.0.11)
[ Find more helpful Linux commands with Network World’s Linux command line cheat sheet ]
The last command
The last command allows you to look further back into time to see both current and older logins, beginning with the most recent and moving back into previous logins.
$ last | head -6 shs pts/1 192.168.0.7 Fri Sep 13 15:23 still logged in fedora tty2 tty2 Fri Sep 13 15:18 still logged in fedora seat0 login screen Fri Sep 13 15:18 still logged in shs pts/1 192.168.0.11 Tue Sep 10 11:51 - 12:26 (00:35) nemo pts/2 192.168.0.11 Fri Sep 13 11:11 still logged in
The command below squeezes the white space into single blank characters.
$ last | head -7 | tr -s " " shs pts/1 192.168.0.7 Fri Sep 13 15:23 still logged in fedora tty2 tty2 Fri Sep 13 15:18 still logged in fedora seat0 login screen Fri Sep 13 15:18 still logged in shs pts/1 192.168.0.11 Tue Sep 10 11:51 - 12:26 (00:35) nemo pts/2 192.168.0.11 Fri Sep 13 11:11 still logged in
Checking the wtmp file
To count logins, you could use a command like the one below that will provide login counts recorded in the current /var/log/wtmp file where logins are recorded. Keep in mind that this is a binary file, so you can’t read its content with grep, more or cat commands.
The command below reports on regular (not system) users – individuals with home directories in /home – and counts their logins.
$ for user in `ls /home` > do > echo -n "$user: " > who /var/log/wtmp | grep "^$user " | wc -l > done brie: 0 dumdum: 0 fedora: 124 george: 1 justme: 0 lola: 19 newuser: 0 shs: 90
To get an idea how old the wtmp file is, you can run a command like this one that displays the first (and, thus, oldest) line in the file.
$ who /var/log/wtmp | head -1 shs pts/3 2024-04-02 16:24 (192.168.0.11)
You will also see the start date of the wtmp file when you run a command like this one where that information is tacked on at the end of the output.
$ last george george pts/2 192.168.0.8 Tue Jul 30 15:32 - 15:32 (00:00) wtmp begins Tue Apr 2 16:24:11 2024
The ac command
The ac command reports on user connect time, and it has a number of other useful options as well.
Use the -d option to view daily login totals as in this example:
$ ac -d | tail -5 Aug 27 total 222.68 Sep 7 total 4.60 Sep 10 total 1.85 Sep 13 total 18.43 Today total 26.73
For user totals, use the -p option:
$ ac -p
lola 5.07
george 0.01
fedora 915.42
shs 124.67
total 1045.17
The lslogins command
The lslogins command will display data on system and user accounts. Since most system accounts never log in, you will see a lot of lines without data in the LAST-LOGIN column.
$ lslogins | head -5
UID USER PROC PWD-LOCK PWD-DENY LAST-LOGIN GECOS
0 root 147 Aug27/13:11 Super User
1 bin 0 bin
2 daemon 0 daemon
3 adm 0 adm
To display user logins without all the system accounts, use a command with the -u option:
$ lslogins -u UID USER PROC PWD-LOCK PWD-DENY LAST-LOGIN GECOS 0 root 145 Aug27/13:11 Super User 1000 fedora 75 Sep13/15:18 fedora 1001 shs 5 12:24 1002 newuser 0 1003 george 0 Jul30/15:32 1004 justme 0 Feb10/12:36 JustMe 1006 lola 0 Jul22/12:30 1007 dumdum 0
You can get quite a lot of information on a single user with a command like that shown below. In this case, the lslogins command is consulting additional files (like the /etc/passwd file) to gather additional information on the user such as the user’s shell and UID.
$ lslogins shs Username: shs UID: 1001 Gecos field: Home directory: /home/shs Shell: /bin/bash No login: no Primary group: shs GID: 1001 Supplementary groups: wheel Supplementary group IDs: 10 Last login: 12:24 Last terminal: pts/1 Last hostname: 192.168.0.7 Hushed: no Running processes: 5 Last logs: 12:29 systemd[52919]: Created slice background.slice - User Background Tasks Slice. 12:29 systemd[52919]: Starting systemd-tmpfiles-clean.service - Cleanup of User's Temporary Files and Directories... 12:29 systemd[52919]: Finished systemd-tmpfiles-clean.service - Cleanup of User's Temporary Files and Directories.
Unless dates are included (e.g., Sep11/12:13), the date is the current date.
The lastlog command
The lastlog command reports the most recent login of all users or for a particular user.
fedora tty2 Fri Sep 13 15:18:43 -0400 2024 shs pts/1 192.168.0.7 Fri Sep 13 15:23:13 -0400 2024 newuser **Never logged in** george pts/2 192.168.0.8 Tue Jul 30 15:32:22 -0400 2024 justme tty2 Sat Feb 10 12:36:19 -0500 2024 lola pts/2 192.168.0.6 Mon Jul 22 12:30:03 -0400 2024 $ lastlog -u george Username Port From Latest george pts/2 192.168.0.8 Tue Jul 30 15:32:22 -0400 2024
Recent commands
To see recent commands that a user has run, you need to have superuser access and take a look at their command history file. For bash users, this will be .bash_history.
# tail ~george/.bash_history pwd touch this ls -l this rm badfile
Wrap-up
Linux systems provide many ways to view user activity – when they login, how long they stay logged in and even what commands they run.
