Source of information

up vote
3
down vote

favorite

I would like to know how the command "who" pulls out information about ssh history into a Linux system. For example, on my shared-network workstation, where everyone can ssh into it:

[johny@gandor ~]$ who
johny :0 2018-08-30 06:44 (:0)
johny pts/0 2018-08-30 06:45 (:0.0)
johny pts/1 2018-08-30 06:45 (:0.0)
Keiven pts/2 2018-08-30 19:46 (:50.0)
seman pts/6 2018-08-31 15:15 (:50.0)
johny pts/7 2018-08-31 15:51 (:50.0)
casper pts/8 2018-08-31 16:53 (:50.0)
johny pts/10 2018-09-01 06:25 (:50.0)

I think that this information is, originally, stored somewhere in Linux system files and the command "who" reads that information from that file? if so, where is that file located?

edited Sep 1 at 13:27

asked Sep 1 at 10:31

Kasper

12611

If you run strace who you'll see exactly what files it's getting the information from.
â€“Â steve
Sep 1 at 10:34

1

Hi Steve, thank you. I use Cantos 7. I don't see any path from the output of "strace". Also cd into "/var/run/utmp." is not feasible. I mean there is no such file!
â€“Â Kasper
Sep 1 at 10:39

1

@Kasper: /var/run/utmp is a file, so you cannot cd into it. You also might want to add the output of strace -e trace=open who to your question.
â€“Â Thomas
Sep 1 at 11:02

Thank you Zeta, I am new to this forum and I am not familiar with the rules. I will re-edit the question. Thanks!
â€“Â Kasper
Sep 1 at 13:26

add a commentÂ |Â

up vote
3
down vote

favorite

I would like to know how the command "who" pulls out information about ssh history into a Linux system. For example, on my shared-network workstation, where everyone can ssh into it:

[johny@gandor ~]$ who
johny :0 2018-08-30 06:44 (:0)
johny pts/0 2018-08-30 06:45 (:0.0)
johny pts/1 2018-08-30 06:45 (:0.0)
Keiven pts/2 2018-08-30 19:46 (:50.0)
seman pts/6 2018-08-31 15:15 (:50.0)
johny pts/7 2018-08-31 15:51 (:50.0)
casper pts/8 2018-08-31 16:53 (:50.0)
johny pts/10 2018-09-01 06:25 (:50.0)

I think that this information is, originally, stored somewhere in Linux system files and the command "who" reads that information from that file? if so, where is that file located?

edited Sep 1 at 13:27

asked Sep 1 at 10:31

Kasper

12611

If you run strace who you'll see exactly what files it's getting the information from.
â€“Â steve
Sep 1 at 10:34

1

Hi Steve, thank you. I use Cantos 7. I don't see any path from the output of "strace". Also cd into "/var/run/utmp." is not feasible. I mean there is no such file!
â€“Â Kasper
Sep 1 at 10:39

1

@Kasper: /var/run/utmp is a file, so you cannot cd into it. You also might want to add the output of strace -e trace=open who to your question.
â€“Â Thomas
Sep 1 at 11:02

Thank you Zeta, I am new to this forum and I am not familiar with the rules. I will re-edit the question. Thanks!
â€“Â Kasper
Sep 1 at 13:26

add a commentÂ |Â

up vote
3
down vote

favorite

I would like to know how the command "who" pulls out information about ssh history into a Linux system. For example, on my shared-network workstation, where everyone can ssh into it:

[johny@gandor ~]$ who
johny :0 2018-08-30 06:44 (:0)
johny pts/0 2018-08-30 06:45 (:0.0)
johny pts/1 2018-08-30 06:45 (:0.0)
Keiven pts/2 2018-08-30 19:46 (:50.0)
seman pts/6 2018-08-31 15:15 (:50.0)
johny pts/7 2018-08-31 15:51 (:50.0)
casper pts/8 2018-08-31 16:53 (:50.0)
johny pts/10 2018-09-01 06:25 (:50.0)

I think that this information is, originally, stored somewhere in Linux system files and the command "who" reads that information from that file? if so, where is that file located?

edited Sep 1 at 13:27

asked Sep 1 at 10:31

Kasper

12611

I would like to know how the command "who" pulls out information about ssh history into a Linux system. For example, on my shared-network workstation, where everyone can ssh into it:

[johny@gandor ~]$ who
johny :0 2018-08-30 06:44 (:0)
johny pts/0 2018-08-30 06:45 (:0.0)
johny pts/1 2018-08-30 06:45 (:0.0)
Keiven pts/2 2018-08-30 19:46 (:50.0)
seman pts/6 2018-08-31 15:15 (:50.0)
johny pts/7 2018-08-31 15:51 (:50.0)
casper pts/8 2018-08-31 16:53 (:50.0)
johny pts/10 2018-09-01 06:25 (:50.0)

I think that this information is, originally, stored somewhere in Linux system files and the command "who" reads that information from that file? if so, where is that file located?

edited Sep 1 at 13:27

asked Sep 1 at 10:31

Kasper

12611

edited Sep 1 at 13:27

asked Sep 1 at 10:31

Kasper

12611

asked Sep 1 at 10:31

Kasper

12611

asked Sep 1 at 10:31

Kasper

12611

If you run strace who you'll see exactly what files it's getting the information from.
â€“Â steve
Sep 1 at 10:34

1

Hi Steve, thank you. I use Cantos 7. I don't see any path from the output of "strace". Also cd into "/var/run/utmp." is not feasible. I mean there is no such file!
â€“Â Kasper
Sep 1 at 10:39

1

@Kasper: /var/run/utmp is a file, so you cannot cd into it. You also might want to add the output of strace -e trace=open who to your question.
â€“Â Thomas
Sep 1 at 11:02

Thank you Zeta, I am new to this forum and I am not familiar with the rules. I will re-edit the question. Thanks!
â€“Â Kasper
Sep 1 at 13:26

add a commentÂ |Â

If you run strace who you'll see exactly what files it's getting the information from.
â€“Â steve
Sep 1 at 10:34

1

Hi Steve, thank you. I use Cantos 7. I don't see any path from the output of "strace". Also cd into "/var/run/utmp." is not feasible. I mean there is no such file!
â€“Â Kasper
Sep 1 at 10:39

1

@Kasper: /var/run/utmp is a file, so you cannot cd into it. You also might want to add the output of strace -e trace=open who to your question.
â€“Â Thomas
Sep 1 at 11:02

Thank you Zeta, I am new to this forum and I am not familiar with the rules. I will re-edit the question. Thanks!
â€“Â Kasper
Sep 1 at 13:26

If you run strace who you'll see exactly what files it's getting the information from.
â€“Â steve
Sep 1 at 10:34

Hi Steve, thank you. I use Cantos 7. I don't see any path from the output of "strace". Also cd into "/var/run/utmp." is not feasible. I mean there is no such file!
â€“Â Kasper
Sep 1 at 10:39

@Kasper: /var/run/utmp is a file, so you cannot cd into it. You also might want to add the output of strace -e trace=open who to your question.
â€“Â Thomas
Sep 1 at 11:02

Thank you Zeta, I am new to this forum and I am not familiar with the rules. I will re-edit the question. Thanks!
â€“Â Kasper
Sep 1 at 13:26

add a commentÂ |Â

2 Answers
2

active

oldest

votes

up vote
5
down vote

accepted

Take a look at the man page for who. e.g. "If FILE is not specified, use /var/run/utmp."

This is not a text file, so opening with vi will offer a poor view of the file contents. od -c /var/run/utmp | more would serve better.

answered Sep 1 at 11:27

steve

12.9k22149

2

@Kasper Adding questions to existing questions is frowned upon. A question should have one acceptable answer. If someone now comes along and answers only the utmp part, none of the answers would be complete. That's why the general rule is: one post = one question. Feel free to open another post (although I've already answered your additional question in my answer, btw).
â€“Â Zeta
Sep 1 at 13:23

add a commentÂ |Â

up vote
5
down vote

If you run strace -e open who, you will see all files that who opens. On Linux, that includes /var/run/utmp. utmp is not a human-readable file, instead it is a sequence of utmp structures (see utmpx(5)). On FreeBSD, who opens /var/run/utx.active.

You can also find this information at who --help, man 1 who or even info who, where the default file is mentioned.

answered Sep 1 at 11:28

Zeta

47627

Good answer, hence +1, and generally strace is the way to go if you want to know what a program does underneath the hood. If there's no interesting file showing up with open() syscalls, that can mean it's likely is communicating with kernel via library and gets information from there.
â€“Â Sergiy Kolodyazhnyy
Sep 1 at 15:26

add a commentÂ |Â

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f466217%2fsource-of-information-command-who%23new-answer', 'question_page');

);

Post as a guest

Name

2 Answers
2

active

oldest

votes

2 Answers
2

active

oldest

votes

up vote
5
down vote

accepted

Take a look at the man page for who. e.g. "If FILE is not specified, use /var/run/utmp."

This is not a text file, so opening with vi will offer a poor view of the file contents. od -c /var/run/utmp | more would serve better.

answered Sep 1 at 11:27

steve

12.9k22149

2

@Kasper Adding questions to existing questions is frowned upon. A question should have one acceptable answer. If someone now comes along and answers only the utmp part, none of the answers would be complete. That's why the general rule is: one post = one question. Feel free to open another post (although I've already answered your additional question in my answer, btw).
â€“Â Zeta
Sep 1 at 13:23

add a commentÂ |Â

up vote
5
down vote

accepted

Take a look at the man page for who. e.g. "If FILE is not specified, use /var/run/utmp."

This is not a text file, so opening with vi will offer a poor view of the file contents. od -c /var/run/utmp | more would serve better.

answered Sep 1 at 11:27

steve

12.9k22149

2

@Kasper Adding questions to existing questions is frowned upon. A question should have one acceptable answer. If someone now comes along and answers only the utmp part, none of the answers would be complete. That's why the general rule is: one post = one question. Feel free to open another post (although I've already answered your additional question in my answer, btw).
â€“Â Zeta
Sep 1 at 13:23

add a commentÂ |Â

up vote
5
down vote

accepted

Take a look at the man page for who. e.g. "If FILE is not specified, use /var/run/utmp."

This is not a text file, so opening with vi will offer a poor view of the file contents. od -c /var/run/utmp | more would serve better.

answered Sep 1 at 11:27

steve

12.9k22149

Take a look at the man page for who. e.g. "If FILE is not specified, use /var/run/utmp."

This is not a text file, so opening with vi will offer a poor view of the file contents. od -c /var/run/utmp | more would serve better.

answered Sep 1 at 11:27

steve

12.9k22149

answered Sep 1 at 11:27

steve

12.9k22149

answered Sep 1 at 11:27

steve

12.9k22149

answered Sep 1 at 11:27

steve

12.9k22149

2

@Kasper Adding questions to existing questions is frowned upon. A question should have one acceptable answer. If someone now comes along and answers only the utmp part, none of the answers would be complete. That's why the general rule is: one post = one question. Feel free to open another post (although I've already answered your additional question in my answer, btw).
â€“Â Zeta
Sep 1 at 13:23

add a commentÂ |Â

2

@Kasper Adding questions to existing questions is frowned upon. A question should have one acceptable answer. If someone now comes along and answers only the utmp part, none of the answers would be complete. That's why the general rule is: one post = one question. Feel free to open another post (although I've already answered your additional question in my answer, btw).
â€“Â Zeta
Sep 1 at 13:23

@Kasper Adding questions to existing questions is frowned upon. A question should have one acceptable answer. If someone now comes along and answers only the utmp part, none of the answers would be complete. That's why the general rule is: one post = one question. Feel free to open another post (although I've already answered your additional question in my answer, btw).
â€“Â Zeta
Sep 1 at 13:23

add a commentÂ |Â

up vote
5
down vote

You can also find this information at who --help, man 1 who or even info who, where the default file is mentioned.

answered Sep 1 at 11:28

Zeta

47627

Good answer, hence +1, and generally strace is the way to go if you want to know what a program does underneath the hood. If there's no interesting file showing up with open() syscalls, that can mean it's likely is communicating with kernel via library and gets information from there.
â€“Â Sergiy Kolodyazhnyy
Sep 1 at 15:26

add a commentÂ |Â

up vote
5
down vote

You can also find this information at who --help, man 1 who or even info who, where the default file is mentioned.

answered Sep 1 at 11:28

Zeta

47627

Good answer, hence +1, and generally strace is the way to go if you want to know what a program does underneath the hood. If there's no interesting file showing up with open() syscalls, that can mean it's likely is communicating with kernel via library and gets information from there.
â€“Â Sergiy Kolodyazhnyy
Sep 1 at 15:26

add a commentÂ |Â

up vote
5
down vote

You can also find this information at who --help, man 1 who or even info who, where the default file is mentioned.

answered Sep 1 at 11:28

Zeta

47627

You can also find this information at who --help, man 1 who or even info who, where the default file is mentioned.

answered Sep 1 at 11:28

Zeta

47627

answered Sep 1 at 11:28

Zeta

47627

answered Sep 1 at 11:28

Zeta

47627

answered Sep 1 at 11:28

Zeta

47627

Good answer, hence +1, and generally strace is the way to go if you want to know what a program does underneath the hood. If there's no interesting file showing up with open() syscalls, that can mean it's likely is communicating with kernel via library and gets information from there.
â€“Â Sergiy Kolodyazhnyy
Sep 1 at 15:26

add a commentÂ |Â

Good answer, hence +1, and generally strace is the way to go if you want to know what a program does underneath the hood. If there's no interesting file showing up with open() syscalls, that can mean it's likely is communicating with kernel via library and gets information from there.
â€“Â Sergiy Kolodyazhnyy
Sep 1 at 15:26

Good answer, hence +1, and generally strace is the way to go if you want to know what a program does underneath the hood. If there's no interesting file showing up with open() syscalls, that can mean it's likely is communicating with kernel via library and gets information from there.
â€“Â Sergiy Kolodyazhnyy
Sep 1 at 15:26

add a commentÂ |Â

draft saved

draft discarded

draft saved

draft discarded

Post as a guest

Name

Search This Blog

Iyfjky