This tutorial shows you how to list users in Linux. You’ll also learn to list only the logged users.
Today different Operating
Systems have the capability to use multiple users, each one with their
settings and custom configurations to make things easier for
administrators and operators to work in together on the same system.
Linux on the other hand is very strong on this matter as it allows
multiple users to work at the same time on the system in an independent
way. It can even allow a single user to open several sessions even from
different locations in order to work on the system.
Here are some hints & tricks to handle users in Linux.
List all the users on Linux
Probably, the very first thing to know is how to know what users are
in my system. There are several ways you can obtain the list of users in
Linux.
1. Show users in Linux using less /etc/passwd
This command allows sysops to list the the users that are locally
stored in the system. It will give the listing in structured way as:
Now if you want to distinguish the normal users from the system users, you can refer to the User ID (UID) number.
Generally,
a normal user has UID greater or equal to 1000. This gives you a hint
that the user with UID >=1000 is a normal user and users with UID
<1000 are="" p="" system="" users.="">
2. View users using getent passwd
This command will give you a similar output as “less /etc/passwd” however, this one actually queries the GNU Name Service Switch functionality configuration file (located at /etc/nsswitch.conf).
This conf includes passwd, so that’s why it will display very similar but if you use LDAP for authentication it will include that as well.
3. List Linux users with compgen
If you just want to list all the usernames without any additional information, you can use the compgen command with -u option.
compgen -u
The output would be like this:
compgen -u
root
daemon
bin
sys
sync
games
man
lp
mail
news
uucp
proxy
www-data
backup
list
irc
gnats
nobody
systemd-network
systemd-resolve
syslog
messagebus
_apt
uuidd
avahi-autoipd
usbmux
dnsmasq
rtkit
cups-pk-helper
speech-dispatcher
whoopsie
kernoops
saned
pulse
avahi
colord
hplip
geoclue
gnome-initial-setup
gdm
abhishek
Tip
You can use compgen
command with -c option to list all the commands available to you. This
is helpful when you are not the admin on a Linux system and don’t have sudo access.
A few tips about listing users in Linux
You just saw three ways to view users in Linux. Here are a few tips that would help you while dealing with the users listing.
List only the usernames
You already have the compgen command for that but you don’t have to remember it all the time.
If we would like to only get a list of the usernames in the system, you can use the awk command or the cut command to filter the output of the other two commands we saw earlier.
cut -d: -f1 /etc/passwd
or
getent passwd | awk -F: '{ print $1}'
Any of these will give us a filtered list of users, showing only the very first column which is username:
root
daemon
bin
sys
sync
games
man
lp
mail
news
johndoe
davmail
statd
Check if a username already exists in the system
This might be useful if you want to know if a particular username already exists in the system:
If you want to know what users are currently logged into your system,
then you need to perform a simple ‘who’ on your command line and this
will immediately list current usernames with an active session to your
system
In this case, the listing will give you not only the list of
usernames connected but also how they are connected, since when they are
connected and from where they are connected.
The very first column will tell you what username is it.
The second column will give you what type of connection it is: if
it’s represented with a “:X” where X is a number, it means it is using a
Graphical User Interface (GUI) or Desktop session such as Gnome, XDE,
etc; if it says “pts/X” where X is a number, it means it’s a connection
made through SSH protocol (command line).
The third column will tell you since when this session has been
connected to the server (date and time). The fourth and last column will
give you the location from where it’s connected, if remote it will
display the IP from where the connection is made if local (like the GUI)
it will display “(:X)” where X is the number of the session in this
case and will match the number in the second column for that row.
Wrapping up
As you can see, listing users in Linux is not difficult at all. It
consists of simple commands which will output all the information for
you, whatever you want to do or obtain of that information is something
you need to filter depending on what you want to check on the system.
Linux
has a robust and mature file system that allows users to exploit a
variety of built-in tools for a range of purposes. Most commonly, users
will access files so that they can be copied, altered, opened and
deleted. Sometimes this is intentional, on other occasions, especially
in the case of servers, it can be malicious.
It is time to channel your inner Sherlock Holmes. We are going file hunting!
Why is this important?
Knowing
when a file was used, accessed or changed can help with unauthorized
access or simply as a way to keep track of what has happened. This
investigation could be on a professional level, with dedicated forensic
analysis, or on a home-user level, trying to see which of their photos
was copied and potentially where it ended up. This article is also meant
to give System Administrators a vital guide to enhance their toolset
for their daily activities and tasks.
Give me the files, stat!
Open
your Terminal and gain root if you need it. Once done, you will be
ready to search for that elusive file or check when things have been
accessed.
The stat command can show file size, type, UID/GUID and the access/modify time.
Here is the stat of my “/etc” folder. Notice the simplicity of the command.
You can see the date it was last accessed, the modify time and the last change.
But I forgot the name!
This
is a common occurrence, especially when digging through an old external
hard drive for that document or photo you need. Luckily the Terminal
comes to the rescue.
The command needed is ls.
There are four principal variables that you can use with ls:
ls-a
This will list all files, including those which are hidden:
ls-l
This enables the long list format:
ls--time-style=FORMAT
This shows the time in a specified format:
ls +%D
This is the show/user date in %m/%d/%y format:
When put together, the command gives us this. It is the basic list of my home directory on an Ubuntu test installation.
You
can see the permissions, the username, date and the location. Mostly
this will suffice in finding the file, but what if you have a directory
with hundreds or thousands of files? Trawling through them manually is
far too time consuming. Therefore, we can narrow down a little by adding
the following flag:
ls-alx--time-style=+%D
This will list things alphabetically, or if you prefer, list the files by size like this:
ls-als--time-style=+%D
Bonus Search
Using the following commands, users can see when a file was accessed.
ls-l--time=atime
Here are some of the options you can set for the time parameter:
atime – updated when file is read
mtime — updated when the file changes
ctime — updated when the file or owner or permissions changes
Find and Seek
Another great tool that Linux has is the find command (more about it here). Let’s say I need the most recently modified files, sorted by reverse order, I would type the following into the Terminal:
find/etc -type f -printf'%TY-%Tm-%Td %TT %p\n'|sort-r
This looks like a very difficult command, but it really isn’t. More can be found on the Ubuntu man page. The result is below.
Hopefully
this article will give you the skills you need to work within the
Terminal to find out whats been happening with a given system. It will
allow you to find out the, “who, where and what” which will let you
secure your server or simply find the document you need. What do you
use? Is there some killer tool or piece of software that you use? Is
there a tool that can run in both the Terminal and has a slick GUI for
beginners? Let us know in the comments section and help your fellow
enthusiasts.
Several commands report on how much memory
is installed and being used on Linux systems. You can be deluged with
details or get a quick and easy answer, depending on the command you
use.
Kevin Stanchfield(CC BY 2.0)There are numerous ways to get information on the memory installed
on Linux systems and view how much of that memory is being used. Some
commands provide an overwhelming amount of detail, while others provide
succinct, though not necessarily easy-to-digest, answers. In this post,
we'll look at some of the more useful tools for checking on memory and
its usage.
Before we get into the details, however, let's review a
few details. Physical memory and virtual memory are not the same. The
latter includes disk space that configured to be used as swap. Swap may
include partitions set aside for this usage or files that are created to
add to the available swap space when creating a new partition may not
be practical. Some Linux commands provide information on both.
Swap
expands memory by providing disk space that can be used to house
inactive pages in memory that are moved to disk when physical memory
fills up.
One file that plays a role in memory management is /proc/kcore.
This file looks like a normal (though extremely large) file, but it
does not occupy disk space at all. Instead, it is a virtual file like
all of the files in /proc.
$ ls -l /proc/kcore
-r--------. 1 root root 140737477881856 Jan 28 12:59 /proc/kcore
Interestingly, the two systems queried below do not have
the same amount of memory installed, yet the size of /proc/kcore is the
same on both. The first of these two systems has 4 GB of memory
installed; the second has 6 GB.
system1$ ls -l /proc/kcore
-r--------. 1 root root 140737477881856 Jan 28 12:59 /proc/kcore
system2$ ls -l /proc/kcore
-r-------- 1 root root 140737477881856 Feb 5 13:00 /proc/kcore
Explanations that claim the size of this file represents the
amount of available virtual memory (maybe plus 4K) don't hold much
weight. This number would suggest that the virtual memory on these
systems is 128 terabytes! That number seems to represent instead how
much memory a 64-bit systems might be capable of addressing — not how
much is available on the system. Calculations of what 128 terabytes and
that number, plus 4K would look like are fairly easy to make on the
command line:
Another and more human-friendly command for examining memory is the free command. It gives you an easy-to-understand report on memory.
$ free
total used free shared buff/cache available
Mem: 6102476 812244 4090752 13112 1199480 4984140
Swap: 2097148 0 2097148
With the -g option, free reports the values in gigabytes.
$ free -g
total used free shared buff/cache available
Mem: 5 0 3 0 1 4
Swap: 1 0 1
With the -t option, free shows the same values
as it does with no options (don't confuse -t with terabytes!) but by
adding a total line at the bottom of its output.
$ free -t
total used free shared buff/cache available
Mem: 6102476 812408 4090612 13112 1199456 4983984
Swap: 2097148 0 2097148
Total: 8199624 812408 6187760
And, of course, you can choose to use both options.
$ free -tg
total used free shared buff/cache available
Mem: 5 0 3 0 1 4
Swap: 1 0 1
Total: 7 0 5
You might be disappointed in this report if you're trying to
answer the question "How much RAM is installed on this system?" This is
the same system shown in the example above that was described as having
6GB of RAM. That doesn't mean this report is wrong, but that it's the
system's view of the memory it has at its disposal.
The free command also provides an option to update the display every X seconds (10 in the example below).
$ free -s 10
total used free shared buff/cache available
Mem: 6102476 812280 4090704 13112 1199492 4984108
Swap: 2097148 0 2097148
total used free shared buff/cache available
Mem: 6102476 812260 4090712 13112 1199504 4984120
Swap: 2097148 0 2097148
With -l, the free command provides high and low memory usage.
$ free -l
total used free shared buff/cache available
Mem: 6102476 812376 4090588 13112 1199512 4984000
Low: 6102476 2011888 4090588
High: 0 0 0
Swap: 2097148 0 2097148
Another option for looking at memory is the /proc/meminfo
file. Like /proc/kcore, this is a virtual file and one that gives a
useful report showing how much memory is installed, free and available.
Clearly, free and available do not represent the same thing. MemFree
seems to represent unused RAM. MemAvailable is an estimate of how much
memory is available for starting new applications.
DirectMap4k represents the amount of memory being mapped to
standard 4k pages, while DirectMap2M shows the amount of memory being
mapped to 2MB pages.
The getconf command is one that will provide quite a bit more information than most of us want to contemplate.
Pare that output down to something specific with a command like
the one shown below, and you'll get the same kind of information
provided by some of the commands above.
$ getconf -a | grep PAGES | awk 'BEGIN {total = 1} {if (NR == 1 || NR == 3) total *=$NF} END {print total / 1024" kB"}'
6102476 kB
That command calculates memory by multiplying the values in the first and last lines of output like this:
Calculating that independently, we can see how that value is derived.
$ expr 4096 \* 1525619 / 1024
6102476
Clearly that's one of those commands that deserves to be turned into an alias!
Another command with very digestible output is top. In the first five lines of top's output, you'll see some numbers that show how memory is being used.
And finally a command that will answer the question "So, how much RAM is installed on this system?" in a succinct fashion:
$ sudo dmidecode -t 17 | grep "Size.*MB" | awk '{s+=$2} END {print s / 1024 "GB"}'
6GB
Depending on how much detail you want to see, Linux systems
provide a lot of options for seeing how much memory is installed on your
systems and how much is used and available.
