1

Working on a Raspberry Pi 2, running Raspbian GNU/Linux 9 (stretch).

I am simply trying to understand why, when I run the top command I can see some users that I cannot see in the who command. Here is output of the commands run on the RPi:

$ top
top - 12:36:42 up 2 days, 15:19,  2 users,  load average: 0.29, 0.34, 0.27
Tasks: 138 total,   1 running,  73 sleeping,   0 stopped,   0 zombie
%Cpu(s):  2.0 us,  0.9 sy,  0.0 ni, 97.0 id,  0.0 wa,  0.0 hi,  0.1 si,  0.0 st
KiB Mem :   949460 total,   354296 free,    62916 used,   532248 buff/cache
KiB Swap:   102396 total,    30972 free,    71424 used.   811488 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
10907 iceman    20   0    6144   3400   1924 S   2.3  0.4   4:05.37 rsync
10876 maverick  20   0    8128   3300   2740 R   1.6  0.3   0:36.49 top
  376 root      20   0  911240   9648   3164 S   0.7  1.0  31:58.38 dockerd
  663 root      20   0  149932   1728   1020 S   0.7  0.2  28:25.48 Xorg
  674 root      20   0  884620   3848   1764 S   0.7  0.4  22:06.18 docker-co


$ who
maverick   pts/0        2018-11-28 11:23 (73.69.181.86)
maverick   pts/1        2018-11-28 11:58 (73.69.181.86)

To clarify, I have tried: who, who -u, who -l, who -p, who -a.

Maverick
  • 23
  • 1
    Because the other users are not logged on, they simply have processes running on the system. Try man who you will see that it list only logged on users. – perror Nov 28 '18 at 12:51
  • 3
    I see now, thank you. With your answer I moved on to ps -ef and others to inspect what users were doing that are not logged on. Reference: How to see process created by specific user in Unix/linux – Maverick Nov 28 '18 at 13:07
  • who and w are only printing in a human-friendly way the content of /var/run/utmp. It doesn't matter if those users are logged in or not, or if the programs they were logged in with started a session, or if they had to enter a password, or whatever; it only matters if they ran a program that bothered to write a record to /var/run/utmp. For instance, I may run su - user, enter a password, etc and user will be nowhere to be seen in the output of w. But if I run xterm +ut, both who and w will show an extra entry for that "session". –  Dec 01 '18 at 04:37

1 Answers1

1

You can find additional information about your system's command-line tools and their parameters by looking at their "man page" (by running man who, for example).

From the respective man pages:

top - display Linux processes

who - show who is logged on

While we're at it, there is also:

w - Show who is logged on and what they are doing.

A user is "logged on" when they have performed a "login", that is they have provided a password or key to authenticate to the system, and the system has launched a "session" for them.

As you can see, who only lists these login sessions — usually together with what the session is attached to, such as

  • an Xserver session (e.g. :0 for the first graphical session),
  • a terminal (tty, e.g. Ctrl+Alt+F2),
  • or a pseudo-terminal (pts, e.g. for an SSH session, terminal emulator or terminal multiplexer program)

There are other ways to start processes that do not involve a login session, such as

  • system services (started by init, systemd, or whatever your system uses for service startup)
  • SSH sessions that did not request a tty device — this usually happens when you give a command directly after the SSH invocation (ssh example.com rsync …) instead of requesting an interactive shell (ssh example.com)
  • starting a process from a login session, but then detaching it from the current shell, and thereby the session (e.g. using disown)

Tangentially, if you want to know what users exist on the system (both locally configured ones from /etc/passwd and any from an external database like LDAP):

getent passwd

If you also want to know when they last logged in:

lastlog
n.st
  • 8,128