dark

who – Displays information about all currently logged in users

The who command is a Linux utility that displays information about all the currently logged-in users on the system. It provides various details about each user, such as the username, terminal name, login time, and remote host name. The who command is useful for system administrators who need to monitor user activity or check for unauthorized access to the system.

Overview

The who command is used in the following format:

who [OPTION]... [FILE]...

The OPTION and FILE arguments are optional. If no arguments are specified, the who command displays a list of all logged-in users on the system, along with their login details.

To display the username, terminal name, and login time of each user, simply run the who command:

who

Output:

user1  tty1         2021-09-01 10:30
user2  pts/0        2021-09-01 11:00 (192.168.1.1)
user3  pts/1        2021-09-01 11:30 (192.168.1.2)

In the output above, the first column represents the username, the second column represents the terminal name, and the third column represents the login time. If a user is logged in remotely, the remote host name or IP address is displayed in parentheses at the end of the line.

Options

The who command supports various options that can be used to customize its output. The available options are listed in the table below:

Option Description
-a, --all Shows all logged-in users, including system users.
-b, --boot Shows the time of the last system boot.
-d, --dead Shows information about dead processes.
-H, --heading Shows a header line at the beginning of the output.
-i, --idle Shows idle time for each user.
-l, --login Shows the login name, process ID, and terminal name of each user.
-m, --mesg Shows the message status for each user.
-p, --process Shows information about processes associated with each user.
-q, --count Shows only the number of logged-in users.
-r, --runlevel Shows the current runlevel.
-s, --short Shows only the username, terminal name, and login time.
-t, --time Shows the last system clock change time.
-T, --wtmp Uses the specified file instead of the default /var/log/wtmp.
--help Displays the help message and exits.
--version Displays version information and exits.

To use an option, simply specify it before the who command. For example, to display the login name, process ID, and terminal name of each user, run the following command:

who -l

Output:

NAME     LINE         TIME             PID COMMENT
user1    tty1         2021-09-01 10:30  1234 (login)
user2    pts/0        2021-09-01 11:00  5678 (bash)
user3    pts/1        2021-09-01 11:30  9012 (bash)

Troubleshooting tips

The who command is a simple utility that does not typically encounter issues. However, if you encounter unexpected output, check the following:

  • Make sure you are running the who command with the correct syntax and options.
  • Check if the user you are looking for is actually logged in. If not, the who command will not display their information.
  • If you are using the -T option to specify a custom file, make sure the file exists and has the correct permissions.

Notes

  • The who command reads its information from the /var/log/wtmp file, which stores login data for all users.
  • The who command is often used in conjunction with other utilities, such as ps and kill, to manage user processes and sessions.

Related commands