by In this tutorial, we will take you through using the who command to check for users currently logged into your Linux or Unix distribution. We also touch on other uses for this helpful command.
You can use the who command to display a range of different information, but it is mainly used to display a list of users logged into a system. You can use additional options to display data such as the last system reboot, dead processes, and much more.
The original implementation of the who utility was released over fifty years ago for the Multics operating system. It was later released as part of Unix and is now found in Unix and Linux distributions. The w command is similar to who but displays more statistics and data.
This guide will briefly touch on the options you can use with the command and why you may want to use them. Hopefully, by the end of the tutorial, you should have a decent understanding of how to use this command effectively.
Table of Contents
who Command Syntax
The who command syntax is very straightforward as it usually consists of just the who keyword followed by options. Advanced users may need to specify a file or multiple arguments. However, just the command keyword and options should suffice.
who [OPTIONS] [ FILE | ARG1 ARG2 ]OPTIONS are where you define the options you wish to apply to the command. We go through some of the options you can use further down the page.
When FILE is not specified, the command will use /var/run/utmp. Otherwise, you can override the default with a different file path. For example, using /var/log/wtmp is common. These files contain the data that the who command uses as a source.
If ARG1 and ARG2 are provided, the option -m is presumed. Typically, “mom likes” or “am I” are given as arguments. No matter the arguments provided, the output will print the same information. For example, “zyz gif” will still result in the same output.
who Command Options
Below are the majority of the options you can use with the who command. In addition, I explain some of the options in more detail, along with some examples further down the page.
-aor--allprints a lot of information. It is the same as using-b -d --login -p -r -t -T -uin the same command.-bor--bootshows the time of the last system boot.-dor--deaddisplays the dead processes.-Hor--headingwill print headers for each column.--ipswill display the IP instead of the hostname. You can use it with--lookupwhich will attempt to canonicalize hostnames based on the stored IP rather than the hostname.-lor--loginwill print the systems login processes.--lookupattempts to canonicalize hostnames using a DNS lookup.-mwill only print the hostname and user associated with the standard input (stdin). Simply, information about the user currently using the terminal.-por--processwill print all the active processes spawned by init.-qor--countwill list all login names and provide a count of all the currently logged-in users-ror--runleveldisplays the current runlevel.-sor--shortwill display the name, line, comment, and time. It is the default setting.-tor--timewill print the last time someone changed the systems clock. If there is no information available, nothing will be printed.-T,-w,--message,--writable, or--mesgdisplays the status of the user’s terminal. The output will show “+” if the terminal is writeable. Otherwise, “–” will be shown indicating the terminal is not writeable. “?” may also be shown if it cannot find the terminal device.-uor--userswill list all the currently logged-in users.--versionoutputs the current version of the who command.
Using the who Command
The who command is straightforward to understand, so it should not take long before you can use it without the help of a guide. We will quickly cover some of the options you are most likely to use.
To begin, we will demonstrate the most basic usage of the who command.
whoWithout any options, the who command will display the name, line, time, and comment.
dev pts/0 2022-02-12 04:18 (192.168.0.39)Show a List of Users Logged In
To use the who command to list all the currently logged-in users, you can use the -u or --users options.
who -uUsing the example above should display a list of all the users. The list includes their name, line, time, idle, PID, and comment. I use the -H option to also display the headers for each column.
NAME LINE TIME IDLE PID COMMENT
dev pts/0 2022-02-12 04:18 04:18 5801 (192.168.0.39)Count the Number of Users Logged in
To list and count all the users that are currently logged into the operating system you can use the -q or --count options.
who -qDepending on the number of logged-in users, you should get something similar to the following output.
pi dev
# users=2Show Date and Time of Last System Boot
You can view when the last system boot occurred using the -b or --boot option.
who -bThe command should return a result that is similar to the example below. It should contain “system boot” followed by the date and time.
system boot 2022-02-10 10:58List Dead Processes
A dead process is a process that still exists in the process table despite completing its execution using the exit system call. Typically these processes do not cause performance issues but might still be worth cleaning up.
To list all the dead processes on the operating system, you can use the -d or --dead option.
who -dDisplay Current System Login Processes
You can use the -l or --login options to view all the current login processes.
who -lYou should get an output that is similar to the example below. I used the -H option so that the output would display headers.
NAME LINE TIME IDLE PID COMMENT
LOGIN tty1 2022-02-10 10:58 757 id=tty1
Display Everything
To have everything displayed about the current user, you can use the -a or --all options. It is equivalent to using the -b -d --login -p -r -t -T -u in the same command.
To use this command, simply enter the following into your terminal.
who -aThis command will print quite a bit of information that should look similar to our example below. Again, I used the -H option to display the headers.
NAME LINE TIME IDLE PID COMMENT EXIT
system boot 2022-02-10 10:58
run-level 5 2022-02-10 10:58
LOGIN tty1 2022-02-10 10:58 757 id=tty1
dev + pts/0 2022-02-12 04:18 05:12 5801 (192.168.0.39)
More Help
There are multiple different ways to get more help for the who command. I will quickly cover the easiest two options that I recommend trying.
Most commands have help pages that can be accessed using the man command on Linux distributions. For example, to bring up the manual pages for the who command, simply enter the following into a terminal.
man whoYou can use the Q key to exit the manual pages.
The command itself has an excellent summary of the options. I find it much easier to skim through than the manual version. To bring up the help information, simply use --help.
who --helpHopefully, either of the above options will help you find the answers you require.
Conclusion
By the end of this guide, I hope you have a decent understanding of the who command and why you might need to use it. I cover most of the common uses of this command, but there is always more you can learn.
If you want to learn more Linux commands, be sure to check out some of our other tutorials. We cover a huge range of different commands, and we are always adding more.
Please let us know if we have missed something in this article or there is something that we need to cover better.
