banshee/linux-collection/linux/ssh/
users
Open sessions and logged-in users of a Linux by SSH, from utmp.
by banshee1 installation2 versions
v2Latest
Published on October 28, 2026. One naming convention across collections; documentation completed.
Logged-in users of a Linux, by SSH
Returns the number of open sessions, on the console as remotely, and the number of distinct users holding them.
Versions
Generic on Debian and Fedora: their C library (glibc) keeps the register, and who without options is the same in BusyBox and GNU coreutils. Not on Alpine: its C library (musl) does not keep the register. The file is missing, who would never return anyone, and the collector stops misconfigured and says so, rather than count zero.
How it works
The collector checks that the session register /var/run/utmp exists (test -e), then runs who and counts its lines, one per session, the account first. A header line USER …, which some who print, is not counted.
- Nothing is written on the target.
Prerequisites
- an SSH account for monitoring, without write rights;
- the fingerprint of the server's host key, set in
protocol:ssh:fingerprint(not needed when the Security settings trust the first SSH fingerprint presented).
Outputs
| Name | Label | Unit | Per instance |
|---|---|---|---|
sessions | Open sessions | — | no |
users | Logged-in users | — | no |
users counts the distinct accounts holding the sessions.
Watches
| Name | Title | Kind | Defaults | Checked by default |
|---|---|---|---|---|
too-many | Too many open sessions | above a threshold, on sessions | no threshold | no |
Limits
- The register only holds sessions with a terminal: a command run over SSH without one (as this collector's own) is not counted.
- Alpine is not supported (see above).