diff --git a/agent/src/collectors/service.rs b/agent/src/collectors/service.rs
index 0cc217d..268a4e3 100644
--- a/agent/src/collectors/service.rs
+++ b/agent/src/collectors/service.rs
@@ -559,7 +559,9 @@ impl ServiceCollector {
     }
 
     async fn get_ssh_active_users(&self) -> Option<String> {
-        let output = Command::new("who")
+        // Use ss to find established SSH connections on port 22
+        let output = Command::new("ss")
+            .args(["-tn", "state", "established", "sport", "= :22"])
             .stdout(Stdio::piped())
             .stderr(Stdio::piped())
             .output()
@@ -571,32 +573,21 @@ impl ServiceCollector {
         }
 
         let stdout = String::from_utf8_lossy(&output.stdout);
-        let mut ssh_users = Vec::new();
+        let mut connections = 0;
         
-        for line in stdout.lines() {
-            let parts: Vec<&str> = line.split_whitespace().collect();
-            if parts.len() >= 2 {
-                let user = parts[0];
-                let terminal = parts[1];
-                // SSH sessions typically show pts/X terminals
-                if terminal.starts_with("pts/") {
-                    ssh_users.push(user);
-                }
+        // Count lines excluding header
+        for line in stdout.lines().skip(1) {
+            if !line.trim().is_empty() {
+                connections += 1;
             }
         }
 
-        if ssh_users.is_empty() {
+        if connections == 0 {
             None
+        } else if connections == 1 {
+            Some("1 SSH connection".to_string())
         } else {
-            let unique_users: std::collections::HashSet<&str> = ssh_users.into_iter().collect();
-            let count = unique_users.len();
-            let users: Vec<&str> = unique_users.into_iter().collect();
-            
-            if count == 1 {
-                Some(format!("1 active user: {}", users[0]))
-            } else {
-                Some(format!("{} active users: {}", count, users.join(", ")))
-            }
+            Some(format!("{} SSH connections", connections))
         }
     }