Linux SysAdmin: Use w and ps commands to find out what other users are doing

There are several utilities to find out what other logged in users are doing on a system, who is currently active, remote host one has used to login, what processes are they runnning and similar such info. In this howto, I will show you how to use 'w' and 'ps' commands to get such information. Such info comes in handy to a sysadmin.

Lets begin with the 'w' command.

Use 'w' command to find out who is logged in on your Linux system

If you run it in a terminal, the output should look something like this, ofcourse its better to try it on a system used by a few logged in users.

[chia]$ w

00:12:45 up  1:33,  5 users,  load average: 0.93, 0.73, 0.77

chia       pts/0    :0.0                 23:23    0.00s   0.22s  0.00s w
user1   pts/1    :115.*.*.*          22:41    9:29    0.24s   0.24s ssh root@some_system
user2   pts/2    :115.118.*.*     23:57    1:13    0.24s   0.03s vnstat

The first line of the output stands for - the  current  time, how  long  the  system  has  been running, how many users are currently logged on, and the system load averages for the past 1, 5, and 15  minutes, in the same order.

The rest of the output shows(each point stands for a column):

• login name
• the tty name
• the remote host used by the user to log in
• login time
• idle time
• JCPU - stands for the time used the processes attached to the tty. It doesn't include past background jobs, but does include currently running background jobs.
• PCPU - time used by the current process
• name of the current process.

Use 'ps' command to find out info about the logged in users on a Linux system

Run the following command in the terminal.

[chia]$ ps au | less

I filtered out the output produced by my laptop, just to reduce clumsiness

USER    PID   %CPU %MEM  VSZ   RSS   TTY   STAT START  TIME  COMMAND
root      1023  11.2    6.3      77232 65460 tty7     Ss+   Jun27   11:56  /usr/bin/X :0 -
root      1222   0.0     0.0      1788   560     tty4     Ss+   Jun27    0:00  /sbin/getty -8
chia     2546   0.0      0.3      6296   3668   pts/1   Ss     Jun27    0:00  bash
chia     4939   0.0      0.0      2004   640     pts/1   S+    00:24     0:00  vnstat --live -i ppp0
chia     4941   0.0      0.1      2712   064     pts/2   R+    00:25    0:00  ps au

The headers are aleady informative about the outputs. VSZ stands for the virtual memory size used by the process in KiB and RSS stands for Resident set size means the non-swapped physical memory a task has used in KiB.