Check who is logged into UNIX server

The answer to the question: "Who is logged on to the system?" is simple. Just use UNIX "who" command:

# who   
root     ttyC0    Dec 30 13:45 
root     ttyp1    Dec 30 14:43   (:0.0)
root     ttyp3    Dec 30 13:47   (:0.0)
root     ttyp4    Dec 30 14:00   (:0.0)
root     ttyp6    Dec 30 14:02   (:0.0)
root     ttypc    Dec 30 14:35   (:0.0)

If this report is not clear, use the "who" command with the addition of -H, to get report Header:

# who -H
USER     LINE     WHEN           FROM 
root     ttyC0    Dec 30 13:45 
root     ttyp1    Dec 30 14:43   (:0.0)
root     ttyp3    Dec 30 13:47   (:0.0)
root     ttyp4    Dec 30 14:00   (:0.0)
root     ttyp6    Dec 30 14:02   (:0.0)
root     ttypc    Dec 30 14:35   (:0.0)

Well, this report is not so interesting at all. Just me. It's ok, there is no any of paratroopers:

With "who -m", or "who am i" or "who i am" you can get info on current terminal:

# who -m 
root     ttyp1    Dec 30 14:43   (:0.0)

# who i am
root     ttyp1    Dec 30 14:43   (:0.0)

# who am i
root     ttyp1    Dec 30 14:43   (:0.0)
# 

Fast report is available with "who -q":

# who -q 
root     root     root     root     root     root     
# users=6
# 

You can get terminal status with "who -T". There is 3 options, writable (+), not writable (-), i some problem (?):

# who -T
root     - ttyC0    Dec 30 13:45 
root     + ttyp1    Dec 30 14:43   (:0.0)
root     + ttyp3    Dec 30 13:47   (:0.0)
root     + ttyp4    Dec 30 14:00   (:0.0)
root     + ttyp6    Dec 30 14:02   (:0.0)
root     + ttypc    Dec 30 14:35   (:0.0) 

Do you want to kick somesone from system ?  No problem, just check idle time with "who -u":

# who -u 
root     ttyC0    Dec 30 13:45 01:09 
root     ttyp1    Dec 30 14:43   .     (:0.0)
root     ttyp2    Dec 30 15:06   .     (:0.0)
root     ttyp3    Dec 30 13:47 00:28   (:0.0)
root     ttyp4    Dec 30 14:00 00:09   (:0.0)
hacker   ttyp5    Dec 30 15:08   .     (localhost)
root     ttyp6    Dec 30 14:02 00:59   (:0.0)
root     ttypc    Dec 30 14:35 00:09   (:0.0)
# 

Well, that was just simple root and some hacker ssh-ing inside.

As always, check your local  man who page.