Linux
banshee/linux-collection/linux/ssh/
users
Open sessions and logged-in users of a Linux by SSH, from utmp.
by banshee1 installation2 versions
Logged-in users of a Linux, by SSH
Returns the number of open sessions, on the console as remotely, and the number of distinct users holding them.
How it works
The collector checks that the session register /var/run/utmp exists (test -e), then runs who and counts its lines, one per session, the account first. A header line USER …, which some who print, is not counted.
- Portable on Debian and Fedora: their C library (glibc) keeps the register, and
whowithout options is the same in BusyBox and GNU coreutils. Nothing is written on the target. - Not on Alpine: its C library (musl) does not keep the register. The file is missing,
whowould never return anyone, and the collector stopsmisconfiguredand says so, rather than count zero.
Prerequisites
- an SSH account for monitoring, without write rights;
- the fingerprint of the server's host key, set in
protocol:ssh:fingerprint(not needed when the Security settings trust the first SSH fingerprint presented).
Outputs
| Output | Meaning |
|---|---|
sessions | open sessions |
users | distinct accounts holding them |
Watches
| Watch | Kind | Defaults | Checked |
|---|---|---|---|
too-many Too many open sessions | above, on sessions | no threshold | no |
Limits
- The register only holds sessions with a terminal: a command run over SSH without one (as this collector's own) is not counted.
- Alpine is not supported (see above).