banshee is under active development: collectors will keep changing, and a version you publish will likely need adjustments. For stable use, wait for version 1.0.0.

Linux

banshee/linux-collection/linux/ssh/

users

Open sessions and logged-in users of a Linux by SSH, from utmp.

  • linux
  • ssh
  • users
  • sessions
  • debian
  • fedora

by banshee1 installation2 versions

Logged-in users of a Linux, by SSH

Returns the number of open sessions, on the console as remotely, and the number of distinct users holding them.

How it works

The collector checks that the session register /var/run/utmp exists (test -e), then runs who and counts its lines, one per session, the account first. A header line USER …, which some who print, is not counted.

  • Portable on Debian and Fedora: their C library (glibc) keeps the register, and who without options is the same in BusyBox and GNU coreutils. Nothing is written on the target.
  • Not on Alpine: its C library (musl) does not keep the register. The file is missing, who would never return anyone, and the collector stops misconfigured and says so, rather than count zero.

Prerequisites

  • an SSH account for monitoring, without write rights;
  • the fingerprint of the server's host key, set in protocol:ssh:fingerprint (not needed when the Security settings trust the first SSH fingerprint presented).

Outputs

OutputMeaning
sessionsopen sessions
usersdistinct accounts holding them

Watches

WatchKindDefaultsChecked
too-many Too many open sessionsabove, on sessionsno thresholdno

Limits

  • The register only holds sessions with a terminal: a command run over SSH without one (as this collector's own) is not counted.
  • Alpine is not supported (see above).