Linux Commands: How To Use "who" And "w" Commands

Summary

In this tutorial, the host explains the basics of two essential Linux commands: `who` and `w`, which are used to determine who's logged into a system. While both commands provide similar information, `who` gives a simpler output, while `w` includes additional details such as user activity. The video covers various options for customizing the commands' output, including filtering user information, checking system uptime, and tracking idle times. The host also discusses practical uses for these commands, such as security monitoring, system maintenance, and script automation. This video is perfect for beginners looking to manage Linux servers effectively.

Takeaways

• 😀 The `who` and `w` commands both show who is logged into a Linux server, but they display the information differently.
• 😀 The `who` command is simpler and shows the username, terminal, login time, and IP address of each user.
• 😀 The `w` command provides additional details, including what each user is currently doing, their idle time, and CPU usage.
• 😀 To check if a server has been breached, the `who` and `w` commands can help identify unexpected logins.
• 😀 The `who am i` command shows details about your current session, which can be useful in certain scenarios.
• 😀 Using the `who -B` option displays the last system boot time, useful for troubleshooting system uptime.
• 😀 The `who -H` option adds headers to the output, making the data easier to read, especially for beginners.
• 😀 The `w` command includes system load averages, which can help determine how busy the system is over different time intervals.
• 😀 The `w` command's idle time column indicates how long a user has been inactive, which is useful for system maintenance or disconnecting idle users.
• 😀 When writing scripts, the `who` command’s simplified output is more script-friendly, while `w` can be used for a more detailed user activity report.

Q & A

What is the purpose of the 'who' command in Linux?

The 'who' command in Linux is used to display a list of users who are currently logged into the system. It shows information such as the username, terminal, login time, and the IP address of the users.

How is the 'w' command different from the 'who' command?

'w' is similar to the 'who' command but provides additional details, such as the current activity or process each user is running. This can be particularly useful to see what users are doing in real-time on the system.

Why is it important for a system administrator to use the 'who' and 'w' commands?

Both commands are essential for system administrators to monitor who is logged into the server, which can help with security audits, system maintenance, or identifying unauthorized access. The 'w' command is especially helpful when tracking user activities.

What does the column 'SSHD' in the output of the 'who' command represent?

'SSHD' indicates that the user logged in remotely using SSH (Secure Shell). If the user was physically present, it would show a TTY (teletype) login instead.

What does the 'pseudo terminal' column in the 'who' command output signify?

The pseudo terminal column shows the terminal number assigned to each user session. Each terminal window in a system gets its own pseudo terminal number, starting from 0 and incrementing with each new session.

Can the 'who' command be used to find out when a server last booted?

Yes, by using the 'who -b' command, you can see the date and time the system was last booted, which is useful for troubleshooting or system maintenance.

What does the '-q' option do in the 'who' command?

The '-q' option in the 'who' command simplifies the output to only show the list of users and a count of how many are logged in. This is useful for scripts or when you need a concise summary of logged-in users.

What does the 'w' command display in the 'what' column?

The 'what' column in the 'w' command output shows what each logged-in user is currently doing. For example, it can show if the user is running a specific command like 'htop' or 'top'.

How can the idle time of a user session be useful?

The idle time tells how long the session has been inactive. This can be useful for system administrators when performing maintenance, as it helps determine which sessions are actively in use and which can be safely logged out.

What is the significance of the 'load average' shown in the 'w' command output?

The load average shows how busy the system has been over the last 1, 5, and 15 minutes. A high load average indicates the system is under heavy usage, while a low value means the system is relatively idle.