I was doing some maintenance on my server today and notice that when I run top, it shows 2 users on the system, but when I run the who or w commands it only shows 1 user (me). Any suggestions of how I can find out who that other user is?

Kind of a weird issue... hopefully someone will have suggestions. I know it could be a hacker... but I would like to know if there is a way to see more info about the user that does not show with who or w.

Thanks in advance.

netstat -an | grep ":22" (assuming your sshd port is 22)
and look who is connected.

Also "last -a".

Can you paste the info from top, and from who so we can take a look at it.