UNIX Tutorial

7. Spying on your neighbors

Commands covered in this section:   who, w, last

Since UNIX is a multi-user system, many users are able to share the resources of a single machine. Consequently, the activities of one user can affect other users logged into the system at the same time. UNIX provides a variety of tools you can use to observe system usage (tools for measuring the utilization of resources such as disk space, cpu time, and memory will be covered in the intermediate tutorial). In this section, we will briefly cover tools which allow you to see who else is currently logged in (who), what command each user is currently running (w), and the last time a given user logged in (last).

Exercise 7.1

Use the who command to see who else is currently logged in.

$ who
natasha    pts/2        Jan 22 08:59    (foo.wossamotta-u.edu)
boris      pts/3        Jan 22 09:27    (bar.wossamotta-u.edu)
rocky      pts/8        Jan 21 23:00    (quux.wossamotta-u.edu)

The resulting display is a table with an entry for each user showing the username, terminal, login date, and location from which the user is logged in (usually the system console or a remote host).

Exercise 7.2

Use w see what program each user is running.

$ w
11:21am  up 2 day(s),  8:40,  3 users,  load average: 0.07, 0.12, 0.13
User     tty          login@   idle   JCPU   PCPU  what
natasha  pts/2        08:59am                      -tcsh
boris    pts/3        09:27am     2      2      2  pine
rocky    pts/8        Thu 11pm 1:30      1      1  emacs junk.txt

In this case, some general information about the system is displayed on the first line (uptime, number of users, and the load average). For each user, the username, terminal, login time, idle time, CPU usage, and currently running program is displayed. The login shell is preceded by a "-" (hyphen) character.

The last command can be used to see the last several logins for a given user.

Exercise 7.3

Check the last three login times for the user "rocky."

$ last -3 rocky
rocky     pts/8   quux.wossamotta-u.edu Thu Jan 21 23:00   still logged in
rocky     pts/4   quux.wossamotta-u.edu Thu Jan 21 08:31 - 17:31  (08:59)
rocky     pts/5   bar.wossamotta-u.edu Wed Jan 20 08:35 - 17:14  (08:38)

The option ("-3" in this case) specifies the number of login entries to be displayed. The resulting display is a table showing the last three logins for the specified user, including username, terminal, location from which user is logged in, login/logout time, and session duration.

Omitting the option specifying the number of entries to be diplayed will cause all logins events for the specified user in the system logs to be displayed. Omitting the username will cause login entries for all users to be displayed.

Exercise 7.4

Display the last three login times for all users.

$ last -3
boris     pts/3   bar.whatsamatt Fri Jan 22 09:27 - still logged in
natasha   pts/2   foo.whatsamat  Fri Jan 22 08:59 - still logged in
rocky     pts/8   quux.whatsamat Thu Jan 21 23:00   still logged in

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.