Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I identify all terminals that have a root login on them on Linux?

who -a seems to give me regular logins but what about root?

share|improve this question
up vote 4 down vote accepted

The who command (and the w command for that matter) also shows root logins, but if someone logged in as a normal user and eleveted his/her rights with su/sudo than it won't show it since the login hasn't really changed.

So in that case you are probably better off looking for su, sudo or /bin/bash (or whatever the shell) processes.

I would guess that something like this should work for you:

ps aux | grep -E '/bin/zsh|/bin/bash'

Although you probably want to look at /etc/shells instead of hardcoding the shells.

share|improve this answer
Additionally, have a look through /var/log/secure, which should identify su's to root and others. – anastrophe Aug 30 '11 at 18:39

Use w to see who is logged on:

w | grep root
share|improve this answer
who (with no additional options) should also list terminals where root is logged in... – voretaq7 Aug 30 '11 at 16:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.