一.查看用戶登錄信息的命令
1. w 查看當前系統上登錄的所有用戶的信息
2. who 查看該shell終端下登錄用戶的詳細信息
3. whoami 查看本shell終端下登陸的用戶
4. last 查看歷史的所有登錄信息
[root@primary_server workspace]# w 14:59:23 up 19 days, 5:35, 1 user, load average: 0.36, 0.37, 0.33 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root pts/0 x.x.x.x 13:06 0.00s 0.36s 0.00s w 注:ip來源的信息也有
[root@primary_server workspace]# who root pts/0 2014-06-15 13:06 (x.x.x.x)
[root@primary_server workspace]# who root
[root@primary_server workspace]# last root pts/0 x.x.x.x Sun Jun 15 13:06 still logged in root pts/0 x.x.x.x Sat Jun 14 17:26 - 17:59 (00:33) root pts/0 x.x.x.x Sat Jun 14 15:50 - 16:05 (00:14) root pts/0 x.x.x.x Wed Jun 11 21:54 - 23:01 (01:07) root pts/0 x.x.x.x Wed Jun 11 15:49 - 17:54 (02:04) root pts/0 x.x.x.x Mon Jun 9 16:44 - 17:57 (01:12) user2 pts/1 x.x.x.x Mon Jun 9 14:54 - 15:00 (00:05) root pts/0 x.x.x.x Mon Jun 9 14:42 - 16:33 (01:51) .................
二.統計歷史前十名登錄系統次數最多的用戶
[root@primary_server workspace]# last |awk -F " " '{ print $3 }' |sort -n |uniq -c |sort -nr |head -10
44 11.11.184.250
36 11.11.184.226
20 11.11.184.251
15 10.18.2.177
14 22.12.112.216
11 11.19.170.90
11 11.237.61.183
10 11.24.239.82
8 boot
8 22.12.112.174