Command-line tools for monitoring system access
Active Connections, Inside and Out
Even more than local activities, connections to and from the outside world are interesting. The w
and whowatch
programs already mentioned gave you some information about activity over the network. An additional tool to use is ss
, which is part of the standard set of tools of any Linux installation. The name of the program comes from socket statistics, and in terms of functionality, it has similarities with netstat
[4], in that it inspects the network sockets for, TCP, UDP, DCCP, and RAW connections and connections to Unix domain sockets. In addition to the statistical information, it lists the existing connections.
The ss
tool offers a variety of options [5]. By using
ss -pl | grep 17500
you will see which processes opened port 17500. In Listing 8, you can see that would be Dropbox, the file exchange service. Option -p
stands for --processes
and displays the process names. The -l
option stands for --listening
and limits the output to existing listening connections only.
Listing 8
Using ss
To obtain a list of all of the existing TCP connections (e.g., IMAP, LDAP, IRC, SSH, HTTP, HTTPS, NFS, and AFS via IPv4 and IPv6), use ss -t
(Listing 9). ESTAB is shown when a connection has been established. CLOSW-WAIT is displayed when the socket is about to close. The other columns show the local and remote IP addresses and the port or the network protocol.
Listing 9
Output of ss -t
You can restrict the output even further if you invoke individual options by employing Boolean operations. The following example filters out all of the existing HTTP connections (Listing 10). You can attain this with option -o state established
or conversely by explicitly stating the network protocol http
for the source address and destination address. Use sport
for source port and dport
for destination port. Again, you must enclose the string in simple quotation marks so that the shell does not evaluate the expression but rather passes it on to ss
as is.
Listing 10
Using ss Filters
You can also filter HTTPS connections that come from outside using the dst
(for destination) keyword and specifying the https
protocol (Listing 11).
Listing 11
Filtering Connections from Outside
History Book
In addition to the active connections, simple system archeology sheds light on activities from the past. By searching the file /var/log/auth.log
, you can figure out which users have logged in and logged out. As the admin user, you can also see the last 10 activities using sshd
. In Listing 12, you can see who logged in, who logged out, and any errors.
Listing 12
Examining auth.log
The last
tool (installed by default on Ubuntu) provides an overview of the last user sessions. It parses the /etc/log/wtmp
file and provides all the activities associated with the login and logout time in reverse order (i.e., the most recent events appear at the top). Listing 13 shows an excerpt from the logged activities where the login, the terminal, the computer of origin, and the time of use are displayed. Currently logged-in users can be identified by the words still logged in in the last column.
Listing 13
Excerpt of Logged Activities
The lastlog
command (included by default on Ubuntu) shows you which authorized users have logged in. It scans the /etc/log/lastlog
file and sorts the output with the user data in /etc/passwd
. Listing 14 shows the login names, the terminal, the source IP addresses, and the last time the user logged in.
Listing 14
Output from lastlog
Conclusion
The tools presented here can give you a clear overview of which users have been on or not been on the systems you manage. You can also obtain insight into the current state of the system and look back at who accessed the system in the past.
Further information about the users can be obtained by using the finger
, cfinger
, or pinky
tools. Gnome enthusiasts can find information in the documentation of the gnome-nettool
program, which uses a nice graphical interface.
Acknowledgments
The author thanks Wolfram Eifler and Axel Beckert for their input and comments for this article.
Infos
- Mosh mobile shell: http://mosh.mit.edu/
- "Persistence: SSH over unreliable connections" by Axel Beckert, Linux Magazine, issue 144, 2012: http://www.linux-magazine.com/Issues/2012/144/Mosh-and-AutoSSH/%28language%29/eng-US
- whowatch, http://sourceforge.net/projects/whowatch/
- Netstat: http://linux.die.net/man/8/netstat
- ss: Display linux TCP/UDP network and socket information: http://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html
« Previous 1 2
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
![Learn More](https://www.linux-magazine.com/var/linux_magazin/storage/images/media/linux-magazine-eng-us/images/misc/learn-more/834592-1-eng-US/Learn-More_medium.png)
News
-
NVIDIA Released Driver for Upcoming NVIDIA 560 GPU for Linux
Not only has NVIDIA released the driver for its upcoming CPU series, it's the first release that defaults to using open-source GPU kernel modules.
-
OpenMandriva Lx 24.07 Released
If you’re into rolling release Linux distributions, OpenMandriva ROME has a new snapshot with a new kernel.
-
Kernel 6.10 Available for General Usage
Linus Torvalds has released the 6.10 kernel and it includes significant performance increases for Intel Core hybrid systems and more.
-
TUXEDO Computers Releases InfinityBook Pro 14 Gen9 Laptop
Sporting either AMD or Intel CPUs, the TUXEDO InfinityBook Pro 14 is an extremely compact, lightweight, sturdy powerhouse.
-
Google Extends Support for Linux Kernels Used for Android
Because the LTS Linux kernel releases are so important to Android, Google has decided to extend the support period beyond that offered by the kernel development team.
-
Linux Mint 22 Stable Delayed
If you're anxious about getting your hands on the stable release of Linux Mint 22, it looks as if you're going to have to wait a bit longer.
-
Nitrux 3.5.1 Available for Install
The latest version of the immutable, systemd-free distribution includes an updated kernel and NVIDIA driver.
-
Debian 12.6 Released with Plenty of Bug Fixes and Updates
The sixth update to Debian "Bookworm" is all about security mitigations and making adjustments for some "serious problems."
-
Canonical Offers 12-Year LTS for Open Source Docker Images
Canonical is expanding its LTS offering to reach beyond the DEB packages with a new distro-less Docker image.
-
Plasma Desktop 6.1 Released with Several Enhancements
If you're a fan of Plasma Desktop, you should be excited about this new point release.