What are the best tools or commands for monitoring SSH sessions on a server?

2 who command

Another command that can help you monitor SSH sessions on a server is the who command. The who command is similar to the w command, but it shows less information by default. The who command only displays the username, terminal, login time, and IP address of the users who are currently logged in to the server. You can also use options like -a, -b, or -r to see more information, such as the system boot time, the run level, or the last system clock change. For example, who -a will show all the information available, including the system boot time, the run level, the login processes, the idle processes, and the processes spawned by init.

3 last command

The last command is another useful tool for monitoring SSH sessions on a server, but it shows the past rather than the present. The last command displays the history of the users who have logged in and out of the server, including their username, terminal, IP address, login time, logout time, and duration of the session. You can use the last command without any options to see the entire history, or you can use options like -n, -f, or -t to limit or filter the output. For example, last -n 10 will show only the last 10 entries, last -f /var/log/wtmp.1 will show the history from a different file than the default one, and last -t 20210901 will show only the entries since September 1, 2021.

4 ps command

The ps command is a versatile tool for monitoring SSH sessions on a server, as well as any other processes running on the server. The ps command displays information about the processes, such as their process ID, user, terminal, CPU time, memory usage, and command. You can use the ps command with various options to select or format the output. For example, ps -u username will show only the processes belonging to a specific user, ps -ax will show all the processes on the server, and ps -o pid,user,tty,time,args will show only the specified fields for each process.

5 kill command

The kill command is not exactly a tool for monitoring SSH sessions on a server, but it is a tool for controlling or terminating them. The kill command sends a signal to a process to make it stop or exit gracefully. You can use the kill command with the process ID of the SSH session that you want to end, or with a signal number or name to specify how to end it. For example, kill 1234 will send the default signal (SIGTERM) to the process with ID 1234, kill -9 1234 will send the SIGKILL signal to the process with ID 1234, which will force it to terminate immediately, and kill -HUP 1234 will send the SIGHUP signal to the process with ID 1234, which will make it hang up and close the connection.

6 snoop command

The snoop command is a tool for monitoring SSH sessions on a server at a lower level, by capturing and analyzing the network packets that are sent and received by the server. The snoop command can help you troubleshoot network issues, detect security breaches, or audit network activity. You can use the snoop command with various options to filter or display the packets. For example, snoop -d eth0 will capture the packets on the eth0 interface, snoop -v will show the verbose output of each packet, and snoop port 22 will show only the packets related to SSH (port 22).