记住基础不牢地动山摇。
方法1-linux里面最短的命令---w
w命令的解释是-显示谁远程登录了系统并且在干什么
|
1
2
3
4
5
6
7
8
9
10
11
|
[root@show regular]# w
20:01:54 up 6 days, 46 min, 5 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/0 10.0.0.1 08:23 0.00s 0.43s 0.00s w
root pts/1 10.0.0.1 20:01 5.00s 0.00s 0.00s -bash
root pts/2 10.0.0.1 20:01 4.00s 0.01s 0.01s -bash
root pts/3 10.0.0.1 20:01 3.00s 0.00s 0.00s -bash
root pts/4 10.0.0.1 20:01 2.00s 0.00s 0.00s -bash
w不只能看用户的登录状态，还能看他们在执行什么命令。
同时还可以看当前系统运行了多久和系统负载----第一行就行 这个相当于uptime命令。
|
who---显示谁远程登录了
|
1
2
3
4
5
6
7
|
[root@show ~]
# who
root pts
/0
2017-04-07 08:23 (10.0.0.1)
root pts
/1
2017-04-07 20:01 (10.0.0.1)
root pts
/2
2017-04-07 20:01 (10.0.0.1)
root pts
/3
2017-04-07 20:01 (10.0.0.1)
root pts
/4
2017-04-07 20:01 (10.0.0.1)
root pts
/5
2017-04-07 21:10 (10.0.0.1)
|
last--显示最近远程登录的用户-也可以查看已经登录的用户
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
[root@show ~]
# last |head -20
root pts
/5
10.0.0.1 Fri Apr 7 21:10 still logged
in
root pts
/4
10.0.0.1 Fri Apr 7 20:01 still logged
in
root pts
/3
10.0.0.1 Fri Apr 7 20:01 still logged
in
root pts
/2
10.0.0.1 Fri Apr 7 20:01 still logged
in
root pts
/1
10.0.0.1 Fri Apr 7 20:01 still logged
in
root pts
/0
10.0.0.1 Fri Apr 7 08:23 still logged
in
root pts
/0
10.0.0.1 Thu Apr 6 08:25 - 22:16 (13:50)
root pts
/1
10.0.0.1 Wed Apr 5 20:26 - 10:16 (13:50)
root pts
/0
10.0.0.1 Tue Apr 4 23:12 - 21:52 (22:39)
root pts
/1
10.0.0.1 Fri Mar 31 20:36 - 09:46 (13:09)
root pts
/0
10.0.0.1 Fri Mar 31 15:47 - 21:55 (06:08)
root pts
/0
10.0.0.1 Fri Mar 31 15:36 - 15:47 (00:11)
reboot system boot 2.6.32-573.8.1.e Fri Mar 31 15:35 - 21:12 (7+05:36)
root pts
/0
10.0.0.1 Thu Mar 30 08:02 - 22:26 (14:24)
root pts
/1
10.0.0.1 Wed Mar 29 22:24 - 10:06 (11:42)
root pts
/0
10.0.0.1 Tue Mar 28 21:50 - 00:02 (1+02:11)
root pts
/0
10.0.0.1 Mon Mar 27 18:16 - 13:49 (19:32)
root pts
/4
10.0.0.1 Sun Mar 26 22:29 - 10:11 (11:42)
root pts
/3
10.0.0.1 Sun Mar 26 08:00 - 10:11 (1+02:10)
root pts
/2
10.0.0.1 Sun Mar 26 07:51 - 08:43 (1+00:51)
|
上面显示的
|
1
2
|
still logged
in
就表示，现在正在远程登录的用户
|
lastlog-显示系统中所用用户的最近一次的登录信息
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
[root@show ~]
# lastlog
Username Port From Latest
root pts
/5
10.0.0.1 Fri Apr 7 21:10:15 +0800 2017
bin **Never logged
in
**
daemon **Never logged
in
**
adm **Never logged
in
**
lp **Never logged
in
**
sync
**Never logged
in
**
shutdown
**Never logged
in
**
halt **Never logged
in
**
mail **Never logged
in
**
uucp **Never logged
in
**
operator **Never logged
in
**
games **Never logged
in
**
gopher **Never logged
in
**
ftp
**Never logged
in
**
nobody **Never logged
in
**
dbus **Never logged
in
**
vcsa **Never logged
in
**
abrt **Never logged
in
**
haldaemon **Never logged
in
**
ntp **Never logged
in
**
saslauth **Never logged
in
**
postfix **Never logged
in
**
sshd **Never logged
in
**
tcpdump **Never logged
in
**
nginx **Never logged
in
**
ntop **Never logged
in
**
www **Never logged
in
**
oldgirl **Never logged
in
**
|
本文转自 李导 51CTO博客，原文链接:http://blog.51cto.com/lidao/1913667
