Open Source

Find out who's using your system with these Linux tools

Learn to use a couple of command-line Linux tools to determine who has logged on to your system.

Delivered each Tuesday, TechRepublic's free Linux NetNote provides tips, articles, and other resources to help you hone your Linux skills. Automatically sign up today!

Linux is a multiuser system, and that means that more than one person can log into the system at any given time. You can also log into the desktop as well as a console (or even two) at the same time.

It's not uncommon to have more than one user connected to a Linux system at one time. Friends or family can connect remotely via ssh.

Determining who has logged into the system is very simple. You can find out by using a couple of small utilities. The easiest to use is the who command, which displays who currently has logged in and from where.

Here's an example:

$ who
root   tty1   Jul 24 10:13
joe           pts/0 Aug 1 14:17 (

This shows you that root has logged in on the first tty (console). It also shows that joe has logged in via ssh, connecting from the machine "" It also indicates the time when these users logged in.

Another useful tool is the last command, which provides information about when a user last connected to the system. Like the who command, the last command returns the username, where they connected, and when they logged in. It also tells you when they logged out or if they're still connected.

Here's an example:

$ last
joe           pts/0 Sun Aug 1 14:17     still logged in

Keeping track of who's been using your computer couldn't be easier using these two command-line tools.

About Vincent Danen

Vincent Danen works on the Red Hat Security Response Team and lives in Canada. He has been writing about and developing on Linux for over 10 years and is a veteran Mac user.

Editor's Picks

Free Newsletters, In your Inbox