记住基础不牢地动山摇。
方法1-linux里面最短的命令---w
w命令的解释是-显示谁远程登录了系统并且在干什么
[root@show regular]# w 20:01:54 up 6 days, 46 min, 5 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root pts/0 10.0.0.1 08:23 0.00s 0.43s 0.00s w root pts/1 10.0.0.1 20:01 5.00s 0.00s 0.00s -bash root pts/2 10.0.0.1 20:01 4.00s 0.01s 0.01s -bash root pts/3 10.0.0.1 20:01 3.00s 0.00s 0.00s -bash root pts/4 10.0.0.1 20:01 2.00s 0.00s 0.00s -bash w不只能看用户的登录状态，还能看他们在执行什么命令。 同时还可以看当前系统运行了多久和系统负载----第一行就行 这个相当于uptime命令。
who---显示谁远程登录了
[root@show ~]# who root pts/0 2017-04-07 08:23 (10.0.0.1) root pts/1 2017-04-07 20:01 (10.0.0.1) root pts/2 2017-04-07 20:01 (10.0.0.1) root pts/3 2017-04-07 20:01 (10.0.0.1) root pts/4 2017-04-07 20:01 (10.0.0.1) root pts/5 2017-04-07 21:10 (10.0.0.1)
last--显示最近远程登录的用户-也可以查看已经登录的用户
[root@show ~]# last |head -20 root pts/5 10.0.0.1 Fri Apr 7 21:10 still logged in root pts/4 10.0.0.1 Fri Apr 7 20:01 still logged in root pts/3 10.0.0.1 Fri Apr 7 20:01 still logged in root pts/2 10.0.0.1 Fri Apr 7 20:01 still logged in root pts/1 10.0.0.1 Fri Apr 7 20:01 still logged in root pts/0 10.0.0.1 Fri Apr 7 08:23 still logged in root pts/0 10.0.0.1 Thu Apr 6 08:25 - 22:16 (13:50) root pts/1 10.0.0.1 Wed Apr 5 20:26 - 10:16 (13:50) root pts/0 10.0.0.1 Tue Apr 4 23:12 - 21:52 (22:39) root pts/1 10.0.0.1 Fri Mar 31 20:36 - 09:46 (13:09) root pts/0 10.0.0.1 Fri Mar 31 15:47 - 21:55 (06:08) root pts/0 10.0.0.1 Fri Mar 31 15:36 - 15:47 (00:11) reboot system boot 2.6.32-573.8.1.e Fri Mar 31 15:35 - 21:12 (7+05:36) root pts/0 10.0.0.1 Thu Mar 30 08:02 - 22:26 (14:24) root pts/1 10.0.0.1 Wed Mar 29 22:24 - 10:06 (11:42) root pts/0 10.0.0.1 Tue Mar 28 21:50 - 00:02 (1+02:11) root pts/0 10.0.0.1 Mon Mar 27 18:16 - 13:49 (19:32) root pts/4 10.0.0.1 Sun Mar 26 22:29 - 10:11 (11:42) root pts/3 10.0.0.1 Sun Mar 26 08:00 - 10:11 (1+02:10) root pts/2 10.0.0.1 Sun Mar 26 07:51 - 08:43 (1+00:51)
上面显示的
still logged in 就表示，现在正在远程登录的用户
lastlog-显示系统中所用用户的最近一次的登录信息
[root@show ~]# lastlog Username Port From Latest root pts/5 10.0.0.1 Fri Apr 7 21:10:15 +0800 2017 bin **Never logged in** daemon **Never logged in** adm **Never logged in** lp **Never logged in** sync **Never logged in** shutdown **Never logged in** halt **Never logged in** mail **Never logged in** uucp **Never logged in** operator **Never logged in** games **Never logged in** gopher **Never logged in** ftp **Never logged in** nobody **Never logged in** dbus **Never logged in** vcsa **Never logged in** abrt **Never logged in** haldaemon **Never logged in** ntp **Never logged in** saslauth **Never logged in** postfix **Never logged in** sshd **Never logged in** tcpdump **Never logged in** nginx **Never logged in** ntop **Never logged in** www **Never logged in** oldgirl **Never logged in**
