1、查看在线用户
- w
[root@dbserver01 ~]# w
16:45:04 up 16 days, 8:48, 1 user, load average: 0.08, 0.07, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
oracle pts/0 192.168.1.116 15:18 0.00s 1:16 0.03s sshd: oracle [priv]
2.查看用户登录历史
- last
oracle pts/0 192.168.1.116 Mon Jul 1 15:18 still logged in
oracle pts/0 192.168.1.116 Tue Jun 25 17:39 - 18:04 (00:25)
oracle pts/0 192.168.1.116 Tue Jun 25 17:13 - 17:14 (00:00)
oracle pts/1 192.168.1.116 Tue Jun 25 15:05 - 15:07 (00:01)
oracle pts/0 192.168.1.116 Tue Jun 25 11:20 - 15:12 (03:51)
3.踢出用户
pkill -KILL -t pts/0 #pts/0为w指令看到的用户终端号
或者:
2)查询某个登录用户的所有进程
[root@firewall ~]# ps -ef | grep pts/0
root 3140 2070 0 23:19 ? 00:00:00 sshd: root@pts/0
root 3142 3140 0 23:19 pts/0 00:00:00 -bash
root 3195 3142 0 23:24 pts/0 00:00:00 ps -ef
root 3196 3142 0 23:24 pts/0 00:00:00 grep pts/0
(3)干掉登录用户Shell 进程
kill -9 3142