一.查看用户登录信息的命令
1. w 查看当前系统上登录的所有用户的信息
2. who 查看该shell终端下登录用户的详细信息
3. whoami 查看本shell终端下登陆的用户
4. last 查看历史的所有登录信息
[root@primary_server workspace]# w 14:59:23 up 19 days, 5:35, 1 user, load average: 0.36, 0.37, 0.33 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root pts/0 x.x.x.x 13:06 0.00s 0.36s 0.00s w 注:ip来源的信息也有
[root@primary_server workspace]# who root pts/0 2014-06-15 13:06 (x.x.x.x)
[root@primary_server workspace]# who root
[root@primary_server workspace]# last root pts/0 x.x.x.x Sun Jun 15 13:06 still logged in root pts/0 x.x.x.x Sat Jun 14 17:26 - 17:59 (00:33) root pts/0 x.x.x.x Sat Jun 14 15:50 - 16:05 (00:14) root pts/0 x.x.x.x Wed Jun 11 21:54 - 23:01 (01:07) root pts/0 x.x.x.x Wed Jun 11 15:49 - 17:54 (02:04) root pts/0 x.x.x.x Mon Jun 9 16:44 - 17:57 (01:12) user2 pts/1 x.x.x.x Mon Jun 9 14:54 - 15:00 (00:05) root pts/0 x.x.x.x Mon Jun 9 14:42 - 16:33 (01:51) .................
二.统计历史前十名登录系统次数最多的用户
[root@primary_server workspace]# last |awk -F " " '{ print $3 }' |sort -n |uniq -c |sort -nr |head -10
44 11.11.184.250
36 11.11.184.226
20 11.11.184.251
15 10.18.2.177
14 22.12.112.216
11 11.19.170.90
11 11.237.61.183
10 11.24.239.82
8 boot
8 22.12.112.174
转载于:https://blog.51cto.com/yangang/1426593