Some commands can help you understand Linux operating system user information

1 displays a list of last logged-in user information, including (logon time, exit time, login IP):

[Email protected] ~]$ last
Root     pts/1        192.168.1.3      Wed 22:08   still logged in   
Sywu     pts/0        192.168.1.3      Wed 21:52 still logged   in   
Reboot   system boot  2.6.32-431.3.1.e Wed 21:51-22:12  (00:21)    
Root     pts/0        192.168.1.3      Mon 23:03-down   (00:11)    
Root     tty1                          Mon 22:48-down   (00:26)    
Reboot   system boot  2.6.32-431.3.1.e Mon 22:47-23:15  (00:27)    
Root     tty1                          Mon 19:32-down   (00:00)    
Reboot   system boot  2.6.32-431.3.1.e Mon 19:23-19:32  (00:09)    
Root     pts/2        192.168.1.3      Sun 22:17-22:36  (00:18)    
Sywu     pts/0        192.168.1.3      Sun 22:13-down   (00:22)

2 Displays the last user logon information (only last), including (logon time, login IP):

--help
Usage:lastlog [Options]
Options:
  --before days             Print only lastlog records older than days
  --help                    Display this help message and exit
  --time days               Print only Lastlog records more recent than days
  --user Login              Print Lastlog record of the specified login
[Email protected] ~]# Lastlog
User name           port     from             last login time
Root             pts/2    192.168.1.3      Day August 24 22:17:05 +0800 2014
GDM                                        * * Never logged in * *
NTP                                        * * never logged in * *
Saslauth                                   * * Never logged in * *
Postfix                                    * * Never logged in * *
Pulse                                      * * never logged in * *
sshd                                       * * Never logged in * *
Tcpdump                                    * * Never logged in * *
Vboxadd                                    * * Never logged in * *
Sywu             pts/0    192.168.1.3      Day August 24 22:13:52 +0800 2014
Lanston          pts/1    192.168.1.100    Day June  8 17:08:10 +0800 2014

3. User information for the last logon failure:

[email protected] ~]$ sudo lastb
Root     ssh:notty    192.168.1.3      Wed 22:16-22:16  (00:00)    
Root     ssh:notty    192.168.1.3      Thu 20:18-20:18  (00:00)    
Btmp begins Thu 21 20:18:11 2014

4. Who logged in to the current system (including IP, logon hours):

--help
Usage: who [options] ... [File | parameter 1 parameter 2]
Displays the user information that is currently logged in.
  --all             equals-b-d--login-p-r-t-t-u option combination
  --boot            last system boot time
  --dead            shows the dead process
  --heading header column for output header
  -L,--login           Displays the system logon process
      --lookup          attempt to verify hostname through DNS
                      -M only faces hosts and users with direct interaction with standard input
  --process shows the active process derived from the INIT process
  --count           List the number of logins and users for all logged-in users
  --runlevel        Display the current RunLevel
  --short           display only name, line, and time (default)
  --MESG        using +,-or? Callout User message Status
  --users           List logged-in users
      --message equals-T
      --writable        equals-t
      --help            Display this help message and exit
      --version         display version information and exit
[Email protected] ~]# Who-a
           System Boot 2014-08-24 22:11
           Run Level 3 2014-08-24 22:11
Login     tty1         2014-08-24 22:13              1996 id=1
Login     tty2         2014-08-24 22:13              1998 id=2
Login     tty3         2014-08-24 22:13              id=3
Login     tty4         2014-08-24 22:13              2002 id=4
Login     tty5         2014-08-24 22:13              id=5
Login     tty6         2014-08-24 22:13              id=6
Sywu     + pts/0        2014-08-24 22:13 00:11        2011 (192.168.1.3)
Root     + pts/2        2014-08-24 22:17   .          2158 (192.168.1.3)

5. What is currently being done by the logged on user:

--help
-- -
Usage:w-HLSUFV [user]
    -H    Skip Header
        -L long listing (default)
    -S short    listing
    -U    ignore uid of processes
        -F Toggle From field (default on)
    -V    display version
[Email protected] ~]# W
22:28:03 up Min,  2 users,  load average:0.01, 0.02, 0.02
USER     TTY      from              [email protected]   IDLE   jcpu   PCPU
Sywu     pts/0    192.168.1.3      22:13   13:21   0.07s  0.01s rlwrap sqlplus/as sysdba
Root     pts/2    192.168.1.3      22:17    0.00s  0.13s  0.00s W

6. Display the User logon time:

[Email protected] ~]$ AC   #总的
        Total      115.46
[Email protected] ~]$ ac-p
        Lanston                              2.30
        Root                                11.35
        Sywu                               101.83
        Total      115.49

Some commands can help you understand Linux operating system user information