Linux: Find Out Who Are Logged On or Were Logged On

There are a few ways to find out who are logged on:

1. Use the w command

#>w
00:03:53 up 4:45, 1 user, load average: 0.00, 0.00, 0.00
SER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/1 192.168.1.107 00:03 0.00s 0.02s 0.00s w

2.  Use who -a command.
Who -a command also provides list all the users who have an open session (currently logon)
 
#>who -a
Feb 24 19:18 518 id=si term=0 exit=0

system boot Feb 24 19:18
run-level 5 Feb 24 19:18 last=S
Feb 24 19:19 4465 id=l5 term=0 exit=0
LOGIN tty1 Feb 24 19:19 5706 id=1
LOGIN tty2 Feb 24 19:19 5709 id=2
Feb 24 19:19 5711 id=3
Feb 24 19:19 5727 id=4
Feb 24 19:19 5739 id=5
LOGIN tty6 Feb 24 19:19 5745 id=6
Feb 24 19:19 5746 id=x
root + pts/1 Feb 25 00:03 00:02 6610 (192.168.1.107)
root + pts/2 Feb 25 00:07 . 6646 (192.168.1.107)

3. Use the users coomand.
The user command shows user ids of the current login users.

#>users
root root

4. Use the last command.
The  last command  looks through /var/log/wtmp and displays a log of the last users logged on, including those currently logged on.

#>last
root pts/2 192.168.1.107 Thu Feb 25 00:07 still logged in
root pts/1 192.168.1.107 Thu Feb 25 00:03 still logged in
reboot system boot 2.6.9-89.ELsmp Wed Feb 24 19:18 (04:54)
root pts/1 192.168.1.107 Wed Feb 24 08:56 - down (00:02)
reboot system boot 2.6.9-89.ELsmp Tue Feb 23 19:28 (13:30)
root pts/2 192.168.1.102 Tue Feb 23 03:39 - 05:50 (02:11)

5.  Check system messages log
You may need root privilege to see the messages

#>grep sshd /var/log/messages

Feb 25 00:03:50 pc-1 sshd(pam_unix)[6608]: session opened for user root by (uid=0)
Feb 25 00:07:16 pc-1 sshd(pam_unix)[6644]: session opened for user root by (uid=0)