With the command w, find out who is logged onto the system and what each user is doing. For example:
$ w 15:17:26 up 62 days, 4:33, 14 users, load average: 0.00, 0.04, 0.01 USER TTY LOGIN@ IDLE JCPU PCPU WHAT jj pts/0 30Mar04 4days 0.50s 0.54s xterm -e su -l jj pts/1 23Mar04 5days 0.20s 0.20s -zsh jj pts/2 23Mar04 5days 1.28s 1.28s -zsh jj pts/3 23Mar04 3:28m 3.21s 0.50s -zsh [...] jj pts/7 07Apr04 0.00s 9.02s 0.01s w jj pts/9 25Mar04 3:24m 7.70s 7.38s mutt [...] jj pts/14 12:49 37:34 0.20s 0.13s ssh totan
The last line shows that user jj has established a secure shell (ssh) connection to the computer totan. If any users of other systems have logged in remotely, the parameter -f will show the computers from which they have established the connection.