The who command is a built-in Linux utility that shows a list of users who are currently logged on to the Linux system.
In this article, you will learn how to use this command and what options it has to offer (with practical examples).
|Root or Sudo Privileges||No|
|Host System and Architecture||Ubuntu 22.10 (x64)|
|OS Compatibility||Ubuntu, Manjaro, Fedora, etc.|
|Discussed Tools in this Article|
Usage of the Who Command
The who command takes two arguments: one is the option, and the other is the file.
$ who [OPTION] [FILE]
If the file field is left empty, then the who command will pull the user related information from the “/var/run/utmp” file.
The following is the output when this command is executed without any options:
The above output contains four fields, followed by
- The name of the logged-in user.
- The user’s terminal.
- The time when the user logged in.
- Host name or IP address from where the user logged-in.
So far, we’ve seen what the output is when no options are specified; now let’s see what the options have to offer.
Who Command Options
The who command provides various options that can change the output based on the specified options, so let’s start with the
Display the Output with Header
-H” flag will display the header for each column in the output.
$ who -H
Display the Output in Verbose Mode
-a” flag will display the output with additional information that includes the info provided by the “
-T“, and “
$ who -a
This way, you can get all the information instead of specifying each option separately.
Display the Time of the Last System Boot
-b” flag will show the time of the last system boot in standard format.
$ who -b
Display the Users Idle Time
-u” flag will show the user’s idle time, which is basically the last time the user interacted with the terminal.
$ who -u
As you can see from the above picture, the “linuxtldr” user has been idle for 6 minutes and 16 seconds.
Display the Dead Processes
-d” flag will list all the dead processes under the referenced username.
$ who -d
Display the Active Processes Spawned by Init
-p” flag will show a list of all the processes spawned by the init.
$ who -p
Display the Total Number of Logged-In Users with their Name
-q” flag will show the name of all the logged-in users to the system, including their count.
$ who -q
Display the Users Terminal Status
-T” flag will show you the terminal status next to each username; it defines whether the user’s terminal has permission for writing messages or not.
Also Read: How to Check, Allow, or Disallow Terminal Write Access in Linux
$ who -T
The following is the list of all the possible permissions:
+” – The terminal is writable.
-” – The terminal is not writable.
?” – Bad line encountered.
Display the Users Login Processes
-l” flag will show the user login processes, or it can be stated as a list of the available terminals.
$ who -l
Display the Current Runlevel
-r” flag can be used to check the current runlevel of the system.
$ who -r
Display the User-Associated Information with the Current Terminal
-m” flag will only show user related information that is associated with the current terminal (or stdin).
$ who -m
Historical Data of the Users
As I’ve stated earlier, this command utilizes the “utmp” file to give the user information, but another file with the name “wtmp” keeps the historical data of the “utmp” file.
You can read this file using the who command to get information about the past logins.
$ who /var/log/wtmp
Identical to this, the “btmp” file keeps the record of failed logins.
$ who /var/log/btmp
So, here comes the end of this article.
If you have any questions or queries related to this topic, then feel free to ask them in the comment section.
Till then, peace!
Join The Conversation
Users are always welcome to leave comments about the articles, whether they are questions, comments, constructive criticism, old information, or notices of typos. Please keep in mind that all comments are moderated according to our comment policy.