Linux VPS

See who is logged in and what they are doing (w, who, last)

Check who is logged in to your Linux VPS right now, what they are running, when each user last logged in and which logins failed, then end a session if needed.

BeginnerLinux server4 min read

When a server behaves oddly, one of the first questions is who else is on it. Linux keeps records of current sessions, past logins and failed attempts, and a few short commands read them. This guide covers w, who, last, lastlog and lastb, and shows how to end someone else's session.

Before you start

  • A Linux VPS with Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9.
  • An SSH session. Most commands work as a normal user; reading failed logins and ending sessions needs sudo.

Note: Some recent releases are replacing the old login record files with a new database called wtmpdb. If last prints nothing or is missing, try wtmpdb last or check the journal as shown later.

See who is logged in right now with w

w is the most useful single command:

Bash
w
 10:41:07 up 3 days,  2:14,  2 users,  load average: 0.04, 0.03, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
deploy   pts/0    198.51.100.20    10:12    0.00s  0.05s  0.00s w
anna     pts/1    203.0.113.55     09:58   12:30   0.10s  0.02s vim /etc/nginx/nginx.conf
  • TTY: the terminal. pts/0, pts/1 and so on are SSH sessions.
  • FROM: the IP address the user connected from.
  • LOGIN@ and IDLE: when they logged in and how long since they typed.
  • WHAT: the command running in that session right now.

To check one user only, run w anna.

Other quick views

who gives a shorter list without the current command:

Bash
who
deploy   pts/0        2026-11-09 10:12 (198.51.100.20)
anna     pts/1        2026-11-09 09:58 (203.0.113.55)

Useful variations:

  • who -b: when the system last booted.
  • whoami: which account your own session is using.
  • users: just the names of logged-in users on one line.

Check login history with last

last reads the record of past logins and logouts, newest first:

Bash
last -n 10
deploy   pts/0        198.51.100.20    Mon Nov  9 10:12   still logged in
anna     pts/1        203.0.113.55     Mon Nov  9 09:58   still logged in
deploy   pts/0        198.51.100.20    Sun Nov  8 17:20 - 18:02  (00:42)
reboot   system boot  6.8.0-45-generic Fri Nov  6 08:27   still running

Narrow it down:

  • last anna: only one user.
  • last -i: show IP addresses instead of host names.
  • last reboot: when the server was restarted.
  • last -s yesterday: only entries since a time.

See each user's last login with lastlog

lastlog shows the most recent login for every account, which helps you spot accounts that should never log in:

Bash
lastlog

System accounts show **Never logged in**. A service account with a recent login deserves a closer look. Check one account with lastlog -u deploy. On some newer releases lastlog has been replaced by lastlog2.

See failed logins with lastb

lastb lists failed login attempts and needs root:

Bash
sudo lastb -n 20

On a public server you will see plenty of attempts with names like admin or test from unknown addresses. That is normal background scanning. What matters is a long run of failures for a real account, or a successful login from an address you do not recognise.

For SSH specifically, the journal is often more complete:

Bash
sudo journalctl -u ssh --since today | grep -E 'Accepted|Failed'

On AlmaLinux and Rocky the unit is sshd, so use -u sshd.

Log out another session

Warning: Ending a session closes it without saving, so an editor or command in that session is lost. Make sure you have the right terminal, and never end your own.

Find the terminal of the session with w, then end everything on that terminal:

Bash
sudo pkill -KILL -t pts/1

To end every session and process of one user:

Bash
sudo pkill -KILL -u anna

If the login came from someone who should not be there, lock the account first so they cannot reconnect, then end the session. See Lock, unlock or disable a Linux user account.

Check it works

Open a second SSH session to the server and run w in the first. You should see two lines for your user with different pts numbers. End the second one with sudo pkill -KILL -t pts/N, using its number. The second window closes with Connection to 203.0.113.10 closed.

Troubleshooting

  • last shows nothing or says the wtmp file is missing: your release may use wtmpdb. Try wtmpdb last, or install the package that provides last on your system.
  • lastb says "Permission denied": the failed login file is readable only by root. Run it with sudo.
  • An unknown IP in w or last: lock the account, end the session, change passwords and SSH keys, and review How to respond to SSH brute-force attempts.
  • w shows a user but pkill -t does nothing: you used the wrong terminal name. Copy it exactly from the TTY column.

Next steps

  • Get notified on every login: Send SSH login alerts.
  • Dig deeper into SSH history: Check SSH login history and failed attempts.
Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AIOpen a ticket

Related guides

Linux VPS

Add a new user on Linux (adduser vs useradd)

Create a new user account on your Linux VPS with adduser on Ubuntu and Debian or useradd on AlmaLinux and Rocky Linux, with a password, home folder and the right shell.

5 min read