How to View All Active User Sessions Ubuntu: who, w, last, and loginctl

Q: How do I see SSH sessions specifically?

`who` shows pts/X (pseudo-terminals) for SSH. The team that filters by pts has SSH-only sessions.

Q: Can I see who logged in hours/days ago?

Yes - `last` reads from wtmp. The team that audits for security has login history.

Q: How do I see currently logged-in users across the network?

Use `pssh` or Ansible to run `who` on multiple hosts. The team that has fleet-wide visibility uses orchestration tools.

How to view all active user sessions Ubuntu: who (current logins), w (with idle time and current command), last (login history from wtmp), or loginctl (systemd sessions, more detail). The team that uses these for security audit, troubleshooting concurrent users, or session management has the right tools.

who - current logins
w - with idle time and command
last - login history
loginctl (systemd)
Current user info
Kill a session
FAQ

who - current logins

who
# Or with header
who -H

Output:

USER     TTY      LOGIN@   IDLE   FROM
alice    tty1     09:00    5:30
bob      pts/0    10:30    .     192.168.1.100

The team that uses who has current logged-in users.

w - with idle time and command

Output:

USER  TTY   LOGIN@  IDLE  JCPU  PCPU  WHAT
alice tty1  09:00   5:30  0.10s  0.05s  -bash
bob   pts/0 10:30   0.00s 0.05s 0.01s  vim file.txt

The team that uses w has idle time + current command.

last
last alice     # only alice's logins
last -n 20     # last 20 logins
last reboot    # system reboot history

Reads from /var/log/wtmp. The team that uses last has login history.

loginctl (systemd)

loginctl list-sessions
# Detail
loginctl show-session <id>
# Active users
loginctl list-users

The team that uses systemd (Ubuntu 16.04+) has loginctl for session management.

Current user info

whoami            # current username
id               # uid, gid, groups
groups            # current user's groups
who am i         # current user (real, not effective)

The team that uses these has current user context.

Kill a session

# Kill specific session
loginctl kill-session <id>

# Or signal the process directly
sudo kill <pid>

The team that needs to terminate a session (e.g., abandoned SSH) uses these.

FAQ

What’s the difference between who and w?

who: basic. w: includes idle time, JCPU, PCPU, current command. The team that uses w has more detail.

How do I see SSH sessions specifically?

who shows pts/X (pseudo-terminals) for SSH. The team that filters by pts has SSH-only sessions.

Can I see who logged in hours/days ago?

Yes - last reads from wtmp. The team that audits for security has login history.

Why does last show old reboots?

Reboots are logged as ‘reboot’ user. The team that filters with last reboot has just reboots.

How do I see currently logged-in users across the network?

Use pssh or Ansible to run who on multiple hosts. The team that has fleet-wide visibility uses orchestration tools.

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references: