Table of Contents
- Introduction
- Why Monitoring Logged-In Users Matters
- Essential Commands to Monitor Logged-In Users
- Summary
1. Introduction
One of the key responsibilities of a Linux system admin or power user is to understand who is on the system at any given time and what they’re doing. Whether you’re troubleshooting, securing your server, or just curious, knowing how to monitor logged-in users is a basic yet powerful skill.
In this article, we’ll go through essential Linux commands to help you track, monitor, and understand user sessions on your system all using tools that come pre-installed on RHEL 9 (so no extra setup needed).
Let’s dive in.
2. Why Monitoring Logged In Users Matters
In multi-user systems especially in production environments it's important to know:
- Who’s currently logged in
- What sessions are active
- What actions are being taken
- Who logged in recently (and when)
This kind of insight can help you catch unauthorized access, detect idle sessions, troubleshoot performance issues, or just better understand system usage.
3. Essential Commands to Monitor Logged In Users
who - Simple Overview of Logged-In Users
What it does:
Displays currently logged-in users, along with terminal, login time, and IP (if remote).
Example:
Why it’s useful:
Great for a quick snapshot of who’s on the system and from where.
w - What Users Are Doing
What it does:
Displays detailed information about logged-in users and what they are currently doing including uptime, load average, and active processes.
Example:
Why it’s useful:
Gives a real-time, detailed view, especially useful for spotting long-running or idle processes.
users - Quick List of Usernames
What it does:
Prints only the usernames of currently logged-in users in a single line.
Example:
Why it’s useful:
Perfect for quick checks or simple scripts where you only need usernames.
id - See Current User Info
What it does:
Shows the current user’s UID, GID, and group memberships.
Example:
Why it’s useful:
Helps you understand user permissions, especially useful when troubleshooting access issues or running permission-based scripts.
last - See Login History
What it does:
Displays a history of logins, including login time, duration, and source IP.
Example:
Why it’s useful:
Great for auditing login activity and detecting unusual patterns or times.
4. Summary
Monitoring users is not just about curiosity, it’s about control, security, and clarity. These five simple but powerful commands help you keep an eye on your system without installing anything extra:
-
who: See who's logged in -
w: Find out what they’re doing -
users: Quick list of usernames -
id: Understand user IDs and groups -
last: Review login history
If you're working on RHEL 9 (Red Hat Linux) or any other Linux system, these tools will give you the visibility you need to stay in charge.
Let me know in the comments if you want to know more about any specific command!