dotlinux blog

Who Linux Command: Explained

In the vast ecosystem of Linux commands, few are as fundamental yet underappreciated as who. Whether you’re a system administrator monitoring user activity, a developer debugging session issues, or a casual user curious about who else is on your machine, who provides critical insights into active user sessions.

At its core, the who command displays information about users currently logged into a Linux or Unix-like system. It reveals details like usernames, login terminals, login times, and even remote host addresses for users accessing the system over the network. In this blog, we’ll dive deep into the who command—its purpose, syntax, options, practical examples, and advanced use cases—to help you master this essential tool.

2026-01

Table of Contents#

  1. What is the who Command?
  2. Basic Syntax
  3. Common Options and Their Usage
  4. Practical Examples
  5. Advanced Usage
  6. Related Commands
  7. Conclusion
  8. References

What is the who Command?#

The who command is a standard Unix/Linux utility that retrieves and displays information about users currently logged into the system. It sources data from the utmp file (usually located at /var/run/utmp), which tracks active user sessions, system events (like reboots), and process information.

Unlike tools like last (which shows historical login data from /var/log/wtmp), who focuses on current activity, making it ideal for real-time monitoring. It’s part of the GNU Core Utilities (coreutils), so it’s preinstalled on nearly all Linux distributions (e.g., Ubuntu, Fedora, CentOS) and Unix systems (e.g., macOS, FreeBSD).

Basic Syntax#

The basic syntax of the who command is:

who [OPTION]... [FILE | ARG1 ARG2]

Breakdown:#

  • [OPTION]...: Optional flags to modify output (e.g., -H for headers, -u for idle time).
  • [FILE | ARG1 ARG2]: By default, who reads from /var/run/utmp. You can specify a different file (e.g., /var/log/wtmp for historical data) or use ARG1 ARG2 for custom queries (rarely used).

In most cases, you’ll run who without arguments to get a quick overview of logged-in users.

Common Options and Their Usage#

The who command offers several options to filter or enrich its output. Below are the most useful ones:

Display All Information: -a#

The -a (or --all) option shows all available information from utmp, including login sessions, dead processes, system boot time, and runlevel changes. It’s equivalent to combining multiple options like -b, -d, -l, -r, -t, -u, and -s.

Output Columns for -a:
NAME (username), LINE (terminal/device), TIME (login time), IDLE (idle time), PID (process ID), COMMENT (additional info, e.g., remote host), EXIT (exit status for dead processes).

Show System Boot Time: -b#

The -b (or --boot) option displays the time when the system was last booted. This is useful for checking uptime-related details.

Example Output:

system boot  2024-05-20 08:15

Add Headers to Output: -H#

The -H (or --heading) option adds column headers to the output, making it easier to interpret. Headers include NAME, LINE, TIME, and COMMENT.

Example:

$ who -H  
NAME     LINE         TIME             COMMENT  
john     pts/0        2024-05-20 10:30 (192.168.1.100)  
jane     tty1         2024-05-20 09:15

Show Only Current User: -m#

The -m option restricts output to the current user’s session. It’s equivalent to running who am i or who mom likes (quirky aliases for the same functionality).

Example:

$ who -m  
john     pts/0        2024-05-20 10:30 (192.168.1.100)

Quick User Count: -q#

The -q (or --count) option provides a quick list of logged-in usernames followed by a total count. It’s ideal for a high-level overview of user activity.

Example:

$ who -q  
john jane  # users=2

Show Current Runlevel: -r#

The -r (or --runlevel) option displays the system’s current runlevel. Runlevels are legacy modes that define system state (e.g., 0 = halt, 1 = single-user, 5 = graphical).

Example Output:

run-level 5  2024-05-20 08:15

Show Idle Time: -u#

The -u (or --users) option adds an IDLE column to the output, showing how long a user has been inactive.

  • . = User is active (no idle time).
  • old = Idle for more than 24 hours.
  • HH:MM = Idle time in hours and minutes (e.g., 00:05 = 5 minutes).

Example:

$ who -u  
john     pts/0        2024-05-20 10:30 00:05 (192.168.1.100)  
jane     tty1         2024-05-20 09:15 .

Other Useful Options#

  • -d (or --dead): Show dead processes (terminated sessions still in utmp).
  • -l (or --login): Show login processes (e.g., getty or sshd waiting for input).
  • -t (or --time): Show the last time the system clock was changed.

Practical Examples#

Let’s walk through real-world scenarios where who shines:

1. Basic User Overview#

Check who’s currently logged in (default behavior):

$ who  
john     pts/0        2024-05-20 10:30 (192.168.1.100)  
jane     tty1         2024-05-20 09:15

Explanation:

  • john is logged in via pts/0 (a pseudo-terminal, typical for SSH or terminal emulators) from 192.168.1.100 (remote IP).
  • jane is logged in via tty1 (a physical terminal, e.g., directly at the machine).

2. Add Headers for Clarity#

Use -H to label columns:

$ who -H  
NAME     LINE         TIME             COMMENT  
john     pts/0        2024-05-20 10:30 (192.168.1.100)  
jane     tty1         2024-05-20 09:15

3. Check System Boot Time#

Find when the system last restarted with -b:

$ who -b  
system boot  2024-05-20 08:15

4. Monitor Idle Users#

Use -uH to see idle time with headers:

$ who -uH  
NAME     LINE         TIME             IDLE          COMMENT  
john     pts/0        2024-05-20 10:30 00:10         (192.168.1.100)  
jane     tty1         2024-05-20 09:15 .

Here, john has been idle for 10 minutes, while jane is active.

5. Quick User Count#

For a server with many users, -q gives a concise summary:

$ who -q  
john jane mike sara  # users=4

Advanced Usage#

Combining Options#

You can combine options to tailor output. For example, -Hu adds headers and idle time:

$ who -Hu  
NAME     LINE         TIME             IDLE          COMMENT  
john     pts/0        2024-05-20 10:30 00:15         (192.168.1.100)

Reading from a Custom File#

By default, who uses /var/run/utmp (current sessions). To view historical data, use /var/log/wtmp (logs all past logins until rotated):

$ who /var/log/wtmp

Note: /var/log/wtmp is typically read-only and may require sudo for access.

While who is great for current sessions, other commands offer complementary insights:

  • last: Shows past login sessions (reads /var/log/wtmp).
    Example: last john (all of John’s past logins).

  • w: Displays detailed user activity, including running processes and CPU usage.
    Example: w (shows users, idle time, and top processes).

  • users: A simpler alternative to who -q, listing only usernames (no count).
    Example: users → john jane.

  • id: Shows the current user’s UID, GID, and group memberships.
    Example: id → uid=1000(john) gid=1000(john) groups=1000(john),4(adm)....

Conclusion#

The who command is a lightweight yet powerful tool for monitoring user sessions in Linux. Whether you need a quick user count, detailed idle times, or system boot information, its options let you tailor output to your needs. By mastering flags like -u (idle time), -b (boot time), and -H (headers), you can efficiently track system activity and diagnose session-related issues.

Next time you’re managing a server or sharing a machine, try who -Hu to see who’s active, how long they’ve been idle, and where they’re logging in from. With practice, who will become an indispensable part of your Linux toolkit.

References#