有关用户登录的信息记录在 utmp(/var/run/utmp)、wtmp(/var/log/wtmp)、btmp(/var/log/btmp) 和 lastlog(/var/log/lastlog) 等文件中。
who、w 和 users 等命令通过 utmp(/var/run/utmp) 文件查询当前登录用户的信息。
last 和 ac 命令通过 wtmp(/var/log/wtmp) 文件查询当前与过去登录系统的用户的信息。
lastb 命令通过 btmp(/var/log/btmp) 文件查询所有登录系统失败的用户的信息。
lastlog 命令通过 lastlog(/var/log/lastlog) 文件查询用户最后一次登录的信息。
who 命令:显示当前当登录的用户的信息
[root@01-0001 tmp]# who
root pts/0 2022-07-04 17:07 (220.181.16.235)
root pts/1 2022-07-04 18:13 (124.126.15.95)
w 命令:显示登录的用户及其当前执行的任务
[root@01-0001 tmp]# w
18:14:31 up 3:44, 2 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/0 220.181.16.235 17:07 0.00s 0.15s 0.00s w
root pts/1 124.126.15.95 18:13 41.00s 0.01s 0.01s -bash
users 命令:显示当前当登录用户的用户名
[root@01-0001 tmp]# users
root root
以上显示有两个root账号登录
last 命令:显示当前与过去登录系统的用户的信息
[root@01-0001 tmp]# last
root pts/1 124.126.15.95 Mon Jul 4 18:13 still logged in
root pts/0 220.181.16.235 Mon Jul 4 17:07 still logged in
root pts/0 124.126.15.95 Mon Jul 4 14:33 - 16:04 (01:31)
reboot system boot 4.18.0-240.el8.x Mon Jul 4 14:29 still running
wtmp begins Tue Nov 2 17:03:20 2021
lastb 命令:显示所有登录系统失败的用户的信息(如果没有做安全限制,每天都会有大量的攻击)
[root@01-0001 tmp]# lastb
app ssh:notty 191.232.193.91 Mon Jul 4 18:16 - 18:16 (00:00)
app ssh:notty 191.232.193.91 Mon Jul 4 18:16 - 18:16 (00:00)
andre ssh:notty 27.254.137.144 Mon Jul 4 18:16 - 18:16 (00:00)
andre ssh:notty 27.254.137.144 Mon Jul 4 18:16 - 18:16 (00:00)
dockerus ssh:notty 75.149.48.196 Mon Jul 4 18:16 - 18:16 (00:00)
dockerus ssh:notty 75.149.48.196 Mon Jul 4 18:16 - 18:16 (00:00)
minecraf ssh:notty 181.188.203.20 Mon Jul 4 18:16 - 18:16 (00:00)
minecraf ssh:notty 181.188.203.20 Mon Jul 4 18:16 - 18:16 (00:00)
wzy ssh:notty 27.254.137.144 Mon Jul 4 18:15 - 18:15 (00:00)
wzy ssh:notty 27.254.137.144 Mon Jul 4 18:15 - 18:15 (00:00)
test ssh:notty 165.232.184.223 Mon Jul 4 18:15 - 18:15 (00:00)
test ssh:notty 165.232.184.223 Mon Jul 4 18:15 - 18:15 (00:00)
root ssh:notty 191.232.193.91 Mon Jul 4 18:15 - 18:15 (00:00)
test ssh:notty 165.232.184.223 Mon Jul 4 18:15 - 18:15 (00:00)
steam ssh:notty 75.149.48.196 Mon Jul 4 18:15 - 18:15 (00:00)
test ssh:notty 165.232.184.223 Mon Jul 4 18:15 - 18:15 (00:00)
steam ssh:notty 75.149.48.196 Mon Jul 4 18:15 - 18:15 (00:00)
amit ssh:notty 181.188.203.20 Mon Jul 4 18:15 - 18:15 (00:00)
amit ssh:notty 181.188.203.20 Mon Jul 4 18:15 - 18:15 (00:00)
。。。
lastlog 命令:显示用户最后一次登录的信息
[root@01-0001 tmp]# lastlog
Username Port From Latest
root pts/1 124.126.15.95 Mon Jul 4 18:13:50 +0800 2022
bin **Never logged in**
daemon **Never logged in**
adm **Never logged in**
lp **Never logged in**
sync **Never logged in**
shutdown **Never logged in**
halt **Never logged in**
mail **Never logged in**
operator **Never logged in**
games **Never logged in**
ftp **Never logged in**
nobody **Never logged in**
dbus **Never logged in**
systemd-coredump **Never logged in**
systemd-resolve **Never logged in**
tss **Never logged in**
polkitd **Never logged in**
libstoragemgmt **Never logged in**
unbound **Never logged in**
setroubleshoot **Never logged in**
cockpit-ws **Never logged in**
cockpit-wsinstance **Never logged in**
sssd **Never logged in**
chrony **Never logged in**
sshd **Never logged in**
rngd **Never logged in**
tcpdump **Never logged in**
cloud-user **Never logged in**
ac 命令:显示用户连接时间的统计数据
a) 显示每天的总的连接时间
[zyq@zyq ~]$ ac -d
...
Jun 10 total 64.34
Jun 13 total 245.78
Jun 14 total 13.93
Jun 20 total 7.63
Jun 21 total 0.00
Jun 22 total 5.96
...
b) 显示每个用户今日的总的连接时间
[zyq@zyq ~]$ ac -p
root 9.79
zyq 6323.47
total 6333.26
c) 显示每个用户的历史总连接时间
[zyq@zyq ~]$ ac -dp
...
May 29 total 26.70
zyq 55.19
Jun 7 total 55.19
root 1.32
zyq 27.46
Jun 8 total 28.78
zyq 22.22
Jun 9 total 22.22
zyq 64.34
...