How does the Linux system administrator know what the user is doing?

Article Title: How does a Linux system administrator know what a user is doing. Linux is a technology channel of the IT lab in China. Including desktop applications, Linux system management, kernel research, embedded systems, open source, and other basic classification Linux systems are a multi-user operating system, each user logging on to the system can execute different programs. However, sometimes administrators need to maintain the operating system, such as restarting the server. At this time, the system administrator must know which users are currently logged on to the system and what operations are being performed. Otherwise, if the administrator forcibly restarts the server, it may cause irreparable losses to other users.

For this reason, the Administrator must be able to understand the users currently logged on and the operations they are performing. Only in this way can the Administrator notify the user to save the file in time, so as not to lose the file. To achieve this goal, the system administrator must use the w command. Next I will analyze how the system administrator can use this command to understand the current operations of users. The command is as follows:

For example, this command can tell you the following information.

Line 1: basic information about the current operation of the system.

In the first line, there are a total of three fields that mainly tell the administrator about the current basic information.

The first field indicates the time information. The previous 09:52:36 indicates the current system time. The following up 14 days indicates that the last system restart has taken nearly 14 days. With this parameter, the administrator can understand the operating duration of the Linux server. This can help administrators with system maintenance. The following indicates the specific time when the server was last started. If the Administrator suspects that the server was accidentally restarted, you can confirm with this parameter.

The second field shows the total number of logon users. Note that in Linux, you can log on to the same account repeatedly, so you will see the duplicate account name. Generally, after a user logs out, the total number of users here is updated in a timely manner.

The third field displays the current average load indication of the system. The preceding three values indicate the average load of the system in the past minute, five minutes, or ten minutes. Generally, the closer the value is to 0, it indicates the system load at the end of the month, and the better performance.

Note:

An experienced system engineer can analyze the above information to obtain valuable information. If the system administrator finds that the system is abnormal and slow, he can observe the average load indication of the system. In general, the administrator can observe every five minutes. If the number of SLB instances in the last five minutes is relatively balanced, there is no problem. However, if there is a big difference in the number of loads in the last five minutes, for example, the second load reaches 10. Then the third observation will return to normal in a timely manner, and the Administrator still needs to find out which task has increased the system load for the last five minutes. The administrator can locate specific abnormal programs through tools such as system logs. It is very likely that this is the culprit of system exceptions. In addition, it should be noted that the load of the system in the last minute is not of great reference significance. Generally, the system administrator should pay attention to the average load of 5 minutes. And you need to observe it three to five times in a row. Only in this way can we get more accurate data.

Row 2: eight fields show the user's details.

The first field "user" shows the username used for logon. Note that Linux is different from Microsoft. Different users can log on to the same account. Therefore, if two accounts with the same name are displayed here, it is not a strange thing.

The second field is TTY, indicating the terminal code that the user logs on. This parameter is of great value to administrators. He can tell the Administrator how the current user logs on to the system. The terminal code varies depending on the user login form. Here, the TTY1-TTY6 represents the virtual console from 1 to 6 on the local machine. PTS indicates that the user logs in remotely. If the number is: 0, the user logs on to the system from XWindow. As shown in, the current user logs on to the Linux operating system through remote access.

[1] [2] Next page