Assess User Activity
If you’re managing a Linux server, it’s good to be ready with a number of commands that you can use to check user activity – when your users are logging in and how often, what groups they belong to, how much disk space they’re consuming, what command they're running, how much disk space they're occupying, if they’re reading their mail and more.
In this post, we'll look at a number of commands that can help you understand who your user are and how they work.
finger
Can see who is logged in (without any arguments)
$ finger
Login Name Tty Idle Login Time Office Office Phone
nemo Nemo Demo pts/1 1:24 Jun 19 12:58 (192.168.0.6)
shs Sandra Henry-Stocker pts/0 Jun 19 12:57 (192.168.0.60With arguments - focuses into individual user
$ finger nemo
Login: nemo Name: Nemo Demo
Directory: /home/nemo Shell: /bin/bash
On since Fri Jun 19 12:58 (EDT) on pts/1 from 192.168.0.6
7 minutes 47 seconds idle
New mail received Wed Jun 17 18:31 2020 (EDT)
Unread since Sat Jun 13 18:03 2020 (EDT)
No Plan.The output above also indicates that nemo doesn't have a "plan", but this just means that he hasn't created a .plan file and put some text into it; this is not at all unusual.
w
The w command also provides a nicely formatted list of currently active users
id
The id command, you can view a user's numeric ID and group ID along with what groups the user is a member of. This information is pulled from the /etc/passwd and /etc/group files. With no arguments, id reports the information for your account.
auth.log
You can yank information from the /var/log/auth.log file with commands like grep. To show the most recent login activity using auth.log data
last
Probably the best for looking at recent logins for all users or one individual. Just remember that last shows the most recent activity first since this is the information that most admins are most interested in.
Last updated
Was this helpful?