if you are running sshd on port 22 this will show you all connections going into it sudo lsof -i :22 you can then reverse what people are doing based on t

if you are running sshd on port 22 this will show you all connections going into it sudo lsof -i :22 you can then reverse what people are doing based on the pids lsof gives you. [edit: using ps ax | grep sshd also works but you can't see where they are connecting from. [+1 daten]]