In this tutorial, we will take you through using the who command to check for users currently logged into your Linux or Unix distribution. We also touch on other uses for this helpful command.
You can use the who command to display a range of different information, but it is mainly used to display a list of users logged into a system. You can use additional options to display data such as the last system reboot, dead processes, and much more.
The original implementation of the who utility was released over fifty years ago for the Multics operating system. It was later released as part of Unix and is now found in Unix and Linux distributions. The
w command is similar to who but displays more statistics and data.
This guide will briefly touch on the options you can use with the command and why you may want to use them. Hopefully, by the end of the tutorial, you should have a decent understanding of how to use this command effectively.
Table of Contents
- who Command Syntax
- who Command Options
- Using the who Command
- More Help
who Command Syntax
The who command syntax is very straightforward as it usually consists of just the who keyword followed by options. Advanced users may need to specify a file or multiple arguments. However, just the command keyword and options should suffice.
who [OPTIONS] [ FILE | ARG1 ARG2 ]
OPTIONS are where you define the options you wish to apply to the command. We go through some of the options you can use further down the page.
When FILE is not specified, the command will use
/var/run/utmp. Otherwise, you can override the default with a different file path. For example, using
/var/log/wtmp is common. These files contain the data that the who command uses as a source.
If ARG1 and ARG2 are provided, the option
-m is presumed. Typically, “mom likes” or “am I” are given as arguments. No matter the arguments provided, the output will print the same information. For example, “zyz gif” will still result in the same output.
who Command Options
Below are the majority of the options you can use with the who command. In addition, I explain some of the options in more detail, along with some examples further down the page.
--allprints a lot of information. It is the same as using
-b -d --login -p -r -t -T -uin the same command.
--bootshows the time of the last system boot.
--deaddisplays the dead processes.
--headingwill print headers for each column.
--ipswill display the IP instead of the hostname. You can use it with
--lookupwhich will attempt to canonicalize hostnames based on the stored IP rather than the hostname.
--loginwill print the systems login processes.
--lookupattempts to canonicalize hostnames using a DNS lookup.
-mwill only print the hostname and user associated with the standard input (stdin). Simply, information about the user currently using the terminal.
--processwill print all the active processes spawned by init.
--countwill list all login names and provide a count of all the currently logged-in users
--runleveldisplays the current runlevel.
--shortwill display the name, line, comment, and time. It is the default setting.
--timewill print the last time someone changed the systems clock. If there is no information available, nothing will be printed.
--mesgdisplays the status of the user’s terminal. The output will show “+” if the terminal is writeable. Otherwise, “–” will be shown indicating the terminal is not writeable. “?” may also be shown if it cannot find the terminal device.
--userswill list all the currently logged-in users.
--versionoutputs the current version of the who command.
Using the who Command
The who command is straightforward to understand, so it should not take long before you can use it without the help of a guide. We will quickly cover some of the options you are most likely to use.
To begin, we will demonstrate the most basic usage of the who command.
Without any options, the who command will display the name, line, time, and comment.
dev pts/0 2022-02-12 04:18 (192.168.0.39)
Show a List of Users Logged In
To use the who command to list all the currently logged-in users, you can use the
Using the example above should display a list of all the users. The list includes their name, line, time, idle, PID, and comment. I use the
-H option to also display the headers for each column.
NAME LINE TIME IDLE PID COMMENT dev pts/0 2022-02-12 04:18 04:18 5801 (192.168.0.39)
Count the Number of Users Logged in
To list and count all the users that are currently logged into the operating system you can use the
Depending on the number of logged-in users, you should get something similar to the following output.
pi dev # users=2
Show Date and Time of Last System Boot
You can view when the last system boot occurred using the
The command should return a result that is similar to the example below. It should contain “system boot” followed by the date and time.
system boot 2022-02-10 10:58
List Dead Processes
A dead process is a process that still exists in the process table despite completing its execution using the exit system call. Typically these processes do not cause performance issues but might still be worth cleaning up.
To list all the dead processes on the operating system, you can use the
Display Current System Login Processes
You can use the
--login options to view all the current login processes.
You should get an output that is similar to the example below. I used the
-H option so that the output would display headers.
NAME LINE TIME IDLE PID COMMENT LOGIN tty1 2022-02-10 10:58 757 id=tty1
To have everything displayed about the current user, you can use the
--all options. It is equivalent to using the
-b -d --login -p -r -t -T -u in the same command.
To use this command, simply enter the following into your terminal.
This command will print quite a bit of information that should look similar to our example below. Again, I used the
-H option to display the headers.
NAME LINE TIME IDLE PID COMMENT EXIT system boot 2022-02-10 10:58 run-level 5 2022-02-10 10:58 LOGIN tty1 2022-02-10 10:58 757 id=tty1 dev + pts/0 2022-02-12 04:18 05:12 5801 (192.168.0.39)
There are multiple different ways to get more help for the who command. I will quickly cover the easiest two options that I recommend trying.
Most commands have help pages that can be accessed using the man command on Linux distributions. For example, to bring up the manual pages for the who command, simply enter the following into a terminal.
You can use the Q key to exit the manual pages.
The command itself has an excellent summary of the options. I find it much easier to skim through than the manual version. To bring up the help information, simply use
Hopefully, either of the above options will help you find the answers you require.
By the end of this guide, I hope you have a decent understanding of the who command and why you might need to use it. I cover most of the common uses of this command, but there is always more you can learn.
If you want to learn more Linux commands, be sure to check out some of our other tutorials. We cover a huge range of different commands, and we are always adding more.
Please let us know if we have missed something in this article or there is something that we need to cover better.