I run a linux file server for my office and we user SFTP for remote partners to login and download files. Is there a way to see if there are any active connections or logins so I can know when it is safe to perform maintenance on the machine?

Since the machine is almost constantly serving large files, scheduled maintenance is often bumped off due to someone either upload


You can also do:

ps -ef | grep '[s]shd' | grep -v ^root

which should show any sshd sessions (which are used for sftp). I notice on my machine my sshd process command line contains '$USER@notty' which makes sense since I'm not logged in with a terminal session. You could tighten up the grep above with:

ps -ef | grep '[s]shd:.*@notty' | grep -v ^root

BTW: the square brackets in the grep are to not have the 'grep sshd' process show up in the process list. [s]shd matches sshd, but doesn't match itself. It saves a 'grep -v grep'

| improve this answer | |
  • 4
    I ended up using netstat -atn | grep ':22' to see if there was open traffic on port 22. I also found that I could check the sshd logs, located at '/var/log/auth.log' on my system to see if all users who had opened a session had been closed out. – aVeRTRAC Aug 10 '11 at 0:30

You could also try fuser -u ssh/tcp

| improve this answer | |

I think you can use the command line program who to see this. I have noticed some reports that doing so doesn't work, but I still think it may work (maybe it's an ssh setting).

sftp is built on top of SSH. It stands for the "SSH File Transfer Protocol". And when you're logged in over ssh, 'who' will include you as a logged in user with its output. So I'd expect this to work with active sftp sessions too.

This discussion from 2008 also suggests that you may use 'netstat' for this. It also includes a suggestion to run 'who' via 'watch' so you can see updates without doing anything.

| improve this answer | |
  • 1
    who does not show users logged in via ssh(I just logged in from my laptop and checked). – aVeRTRAC Aug 10 '11 at 0:27
  • That's wacky, that's GOT to be a setting.. As I'm pretty damned sure it has done so for me.. for years and years and years.. – James T Snell Aug 10 '11 at 1:42
  • Any idea where that setting would be? I tried this on a public server at my work & got back what looks like realistic results with several users listed. – aVeRTRAC Aug 15 '11 at 21:10
  • 1
    who shows who is currently running a login shell. Depending on what the user is running, it may or may not count as a login shell. The server half of sftp does not, hence why sftp sessions don't show up in who. – Perkins Oct 22 '15 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.