Show users logged in linux
Active user sessions and what they are running
who -H && w
more linux
all 133 commands →
Last logins
last -n 20 | head -25
Failed login attempts
journalctl -u ssh --since '24h ago' | grep 'Failed password' | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -10
Check sudo access
sudo -l -U <username>
Add user to group
usermod -aG docker,sudo alice
Show /proc memory maps
cat /proc/<pid>/smaps | awk '/^Size/{sum+=$2} END{print sum/1024" MB"}'