Who is using my server? what are you doing? when?

reason

If your server is not exclusive , Including multiple users, etc , Worried about what he did “ Bad thing ”？ Use the following command to query .

Who is connected to this server ？

Use who command

  
  
  
  
  

   
   
   
   [email protected]:~# whoroot pts/0 2022-05-19 23:38 (x.x.x.x)root pts/2 2022-05-19 22:44 (x.x.x.x)
  
  
  
  
Code language: PHP (php)

Doing? ？

Use w command

  
  
  
  

   
   
   
   [email protected]:~# w 23:40:26 up 1 day, 8:54, 2 users, load average: 0.20, 0.11, 0.09USER TTY FROM [email protected] IDLE JCPU PCPU WHATroot pts/0 x.x.x.x 23:38 1.00s 0.02s 0.00s wroot pts/2 x.x.x.x 22:44 45:05 0.01s 0.01s -bash
  
  
  
  
Code language: PHP (php)

When ？

Use last command

  
  
  
  

   
   
   
   [email protected]:~# lastroot pts/0 x.x.x.x Thu May 19 23:38 still logged inroot pts/2 x.x.x.x Thu May 19 22:44 still logged inroot pts/0 x.x.x.x Thu May 19 22:17 - 23:01 (00:43)root pts/0 x.x.x.x Thu May 19 22:03 - 22:03 (00:00)
  
  
  
  
Code language: PHP (php)

Who is connected ？

Use netstat -t | grep ssh or ssh-port command

  
  
  
  

   
   
   
   [email protected]:~# netstat -t | grep xxxxtcp 0 0 ubuntu:xxxx x.x.x.x:xxxxx ESTABLISHEDtcp 0 80 ubuntu:xxxx x.x.x.x:xxxxx ESTABLISHED
  
  
  
  
Code language: PHP (php)

Tips： The above commands can be found in manual For more information .