How do I find current root logins

Question

How can I identify all terminals that have a root login on them on Linux?

who -a seems to give me regular logins but what about root?

Answer 1

The who command (and the w command for that matter) also shows root logins, but if someone logged in as a normal user and eleveted his/her rights with su/sudo than it won't show it since the login hasn't really changed.

So in that case you are probably better off looking for su, sudo or /bin/bash (or whatever the shell) processes.

I would guess that something like this should work for you:

ps aux | grep -E '/bin/zsh|/bin/bash'

Although you probably want to look at /etc/shells instead of hardcoding the shells.

Answer 2

Use w to see who is logged on:

w | grep root