How to Monitor All Logged-in Users

Prerequisites

Before monitoring logged-in users, make sure you have:

• SSH access to your VPS

Method 1: Using who (Simple List)

Connect to your VPS:

ssh hxroot@YOUR_SERVER_IP -p 22

who

Example output:

hxroot   pts/0        2026-04-29 09:30 (203.0.113.45)
john     pts/1        2026-04-29 10:15 (192.168.1.100)

Shows: username, terminal, login time, source IP.

Method 2: Using w (Detailed)

w

Example output:

 10:30:15 up 2 days,  1:20,  2 users,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
hxroot   pts/0    203.0.113.45     09:30    0.00s  0.23s  0.02s w
john     pts/1    192.168.1.100    10:15    5:23m  0.05s  0.05s top

Shows what command each user is running.

Method 3: Using users (Only Usernames)

users

Output: hxroot john

Method 4: Using who -a (All Information)

who -a

Method 5: Using last (Recent Logins)

last -5

Shows last 5 logins, including still logged in users.

Method 6: Using ps (Find User Processes)

ps aux | grep john

Monitor Login Activity in Real Time

watch -n 2 who

Updates every 2 seconds. Press Ctrl+C to exit.

Monitor Failed Login Attempts in Real Time

sudo tail -f /var/log/auth.log | grep "Failed password"

Send Alert When New User Logs In

Add to /etc/profile (global) or ~/.bashrc:

#!/bin/bash
echo "User $USER logged in from $(who am i | awk '{print $5}') at $(date)" >> /var/log/login.log
mail -s "Login Alert" admin@example.com < /var/log/login.log

Kill a User Session

Find the terminal (TTY) from who, then:

sudo pkill -9 -t pts/1

Or log them out:

sudo skill -KILL -u john

Set Timeout for Idle Sessions (Disconnect Inactive Users)

Edit /etc/ssh/sshd_config:

ClientAliveInterval 300
ClientAliveCountMax 2

Restart SSH:

sudo systemctl restart sshd

This disconnects idle sessions after 10 minutes (300s * 2).