How to use the who Command

In this tutorial, we will take you through using the who command to check for users currently logged into your Linux or Unix distribution. We also touch on other uses for this helpful command.

How to use the who command

You can use the who command to display a range of different information, but it is mainly used to display a list of users logged into a system. You can use additional options to display data such as the last system reboot, dead processes, and much more.

The original implementation of the who utility was released over fifty years ago for the Multics operating system. It was later released as part of Unix and is now found in Unix and Linux distributions. The w command is similar to who but displays more statistics and data.

This guide will briefly touch on the options you can use with the command and why you may want to use them. Hopefully, by the end of the tutorial, you should have a decent understanding of how to use this command effectively.

Table of Contents

who Command Syntax

The who command syntax is very straightforward as it usually consists of just the who keyword followed by options. Advanced users may need to specify a file or multiple arguments. However, just the command keyword and options should suffice.

 who [OPTIONS] [ FILE | ARG1 ARG2 ]

OPTIONS are where you define the options you wish to apply to the command. We go through some of the options you can use further down the page.

When FILE is not specified, the command will use /var/run/utmp. Otherwise, you can override the default with a different file path. For example, using /var/log/wtmp is common. These files contain the data that the who command uses as a source.

If ARG1 and ARG2 are provided, the option -m is presumed. Typically, “mom likes” or “am I” are given as arguments. No matter the arguments provided, the output will print the same information. For example, “zyz gif” will still result in the same output.

who Command Options

Below are the majority of the options you can use with the who command. In addition, I explain some of the options in more detail, along with some examples further down the page.

  • -a or --all prints a lot of information. It is the same as using -b -d --login -p -r -t -T -u in the same command.
  • -b or --boot shows the time of the last system boot.
  • -d or --dead displays the dead processes.
  • -H or --heading will print headers for each column.
  • --ips will display the IP instead of the hostname. You can use it with --lookup which will attempt to canonicalize hostnames based on the stored IP rather than the hostname.
  • -l or --login will print the systems login processes.
  • --lookup attempts to canonicalize hostnames using a DNS lookup.
  • -m will only print the hostname and user associated with the standard input (stdin). Simply, information about the user currently using the terminal.
  • -p or --process will print all the active processes spawned by init.
  • -q or --count will list all login names and provide a count of all the currently logged-in users
  • -r or --runlevel displays the current runlevel.
  • -s or --short will display the name, line, comment, and time. It is the default setting.
  • -t or --time will print the last time someone changed the systems clock. If there is no information available, nothing will be printed.
  • -T, -w, --message, --writable, or --mesg displays the status of the user’s terminal. The output will show “+” if the terminal is writeable. Otherwise, “” will be shown indicating the terminal is not writeable. “?” may also be shown if it cannot find the terminal device.
  • -u or --users will list all the currently logged-in users.
  • --version outputs the current version of the who command.

Using the who Command

The who command is straightforward to understand, so it should not take long before you can use it without the help of a guide. We will quickly cover some of the options you are most likely to use.

To begin, we will demonstrate the most basic usage of the who command.


Without any options, the who command will display the name, line, time, and comment.

dev      pts/0        2022-02-12 04:18 (

Show a List of Users Logged In

To use the who command to list all the currently logged-in users, you can use the -u or --users options.

who -u

Using the example above should display a list of all the users. The list includes their name, line, time, idle, PID, and comment. I use the -H option to also display the headers for each column.

NAME     LINE         TIME             IDLE          PID COMMENT
dev      pts/0        2022-02-12 04:18 04:18        5801 (

Count the Number of Users Logged in

To list and count all the users that are currently logged into the operating system you can use the -q or --count options.

who -q

Depending on the number of logged-in users, you should get something similar to the following output.

pi dev
# users=2

Show Date and Time of Last System Boot

You can view when the last system boot occurred using the -b or --boot option.

who -b

The command should return a result that is similar to the example below. It should contain “system boot” followed by the date and time.

         system boot  2022-02-10 10:58

List Dead Processes

A dead process is a process that still exists in the process table despite completing its execution using the exit system call. Typically these processes do not cause performance issues but might still be worth cleaning up.

To list all the dead processes on the operating system, you can use the -d or --dead option.

who -d

Display Current System Login Processes

You can use the -l or --login options to view all the current login processes.

who -l

You should get an output that is similar to the example below. I used the -H option so that the output would display headers.

NAME     LINE         TIME             IDLE          PID COMMENT
LOGIN    tty1         2022-02-10 10:58               757 id=tty1

Display Everything

To have everything displayed about the current user, you can use the -a or --all options. It is equivalent to using the -b -d --login -p -r -t -T -u in the same command.

To use this command, simply enter the following into your terminal.

who -a

This command will print quite a bit of information that should look similar to our example below. Again, I used the -H option to display the headers.

NAME       LINE         TIME             IDLE          PID COMMENT  EXIT
           system boot  2022-02-10 10:58
           run-level 5  2022-02-10 10:58
LOGIN      tty1         2022-02-10 10:58               757 id=tty1
dev      + pts/0        2022-02-12 04:18 05:12        5801 (

More Help

There are multiple different ways to get more help for the who command. I will quickly cover the easiest two options that I recommend trying.

Most commands have help pages that can be accessed using the man command on Linux distributions. For example, to bring up the manual pages for the who command, simply enter the following into a terminal.

man who

You can use the Q key to exit the manual pages.

The command itself has an excellent summary of the options. I find it much easier to skim through than the manual version. To bring up the help information, simply use --help.

who --help

Hopefully, either of the above options will help you find the answers you require.


By the end of this guide, I hope you have a decent understanding of the who command and why you might need to use it. I cover most of the common uses of this command, but there is always more you can learn.

If you want to learn more Linux commands, be sure to check out some of our other tutorials. We cover a huge range of different commands, and we are always adding more.

Please let us know if we have missed something in this article or there is something that we need to cover better.

Leave a Reply

Your email address will not be published. Required fields are marked *