who command is a Linux utility that displays information about all the currently logged-in users on the system. It provides various details about each user, such as the username, terminal name, login time, and remote host name. The
who command is useful for system administrators who need to monitor user activity or check for unauthorized access to the system.
who command is used in the following format:
who [OPTION]... [FILE]...
FILE arguments are optional. If no arguments are specified, the
who command displays a list of all logged-in users on the system, along with their login details.
To display the username, terminal name, and login time of each user, simply run the
user1 tty1 2021-09-01 10:30 user2 pts/0 2021-09-01 11:00 (192.168.1.1) user3 pts/1 2021-09-01 11:30 (192.168.1.2)
In the output above, the first column represents the username, the second column represents the terminal name, and the third column represents the login time. If a user is logged in remotely, the remote host name or IP address is displayed in parentheses at the end of the line.
who command supports various options that can be used to customize its output. The available options are listed in the table below:
||Shows all logged-in users, including system users.|
||Shows the time of the last system boot.|
||Shows information about dead processes.|
||Shows a header line at the beginning of the output.|
||Shows idle time for each user.|
||Shows the login name, process ID, and terminal name of each user.|
||Shows the message status for each user.|
||Shows information about processes associated with each user.|
||Shows only the number of logged-in users.|
||Shows the current runlevel.|
||Shows only the username, terminal name, and login time.|
||Shows the last system clock change time.|
||Uses the specified file instead of the default
||Displays the help message and exits.|
||Displays version information and exits.|
To use an option, simply specify it before the
who command. For example, to display the login name, process ID, and terminal name of each user, run the following command:
NAME LINE TIME PID COMMENT user1 tty1 2021-09-01 10:30 1234 (login) user2 pts/0 2021-09-01 11:00 5678 (bash) user3 pts/1 2021-09-01 11:30 9012 (bash)
who command is a simple utility that does not typically encounter issues. However, if you encounter unexpected output, check the following:
- Make sure you are running the
whocommand with the correct syntax and options.
- Check if the user you are looking for is actually logged in. If not, the
whocommand will not display their information.
- If you are using the
-Toption to specify a custom file, make sure the file exists and has the correct permissions.
whocommand reads its information from the
/var/log/wtmpfile, which stores login data for all users.
whocommand is often used in conjunction with other utilities, such as
kill, to manage user processes and sessions.