There are several ways you can monitor Linux user activity in real time:
Use the w command. The w command displays information about the users currently logged in to the system, including the terminal they are using, the time they logged in, and the command they are running.
Use the who command. The who command displays a list of users currently logged in to the system, including their terminal, login time, and IP address.
Use the last command. The last command displays a list of users who have logged in to the system, along with the time of their login and logout. You can use the -f option to follow the log in real time.
Use the ps command. The ps command displays a list of processes currently running on the system. You can use the -u option to show only the processes belonging to a specific user.
Use the top command. The top command displays a real-time view of the processes running on the system, including the user who owns each process. You can use the u option to filter the display by a specific user.
Keep in mind that these tools only show the activity of users who are currently logged in to the system. If you want to monitor user activity over a longer period of time, you can use a system logging tool such as syslog or rsyslog to collect and analyze log messages.