Beginners Guide for Who Command in Linux

The who command is a built-in Linux utility that shows a list of users who are currently logged on to the Linux system.

In this article, you will learn how to use this command and what options it has to offer (with practical examples).

Tutorial Details

Usage of the Who Command

The who command takes two arguments: one is the option, and the other is the file.

$ who [OPTION] [FILE]

If the file field is left empty, then the who command will pull the user related information from the “/var/run/utmp” file.

The following is the output when this command is executed without any options:

$ who

Output:

The above output contains four fields, followed by

• The name of the logged-in user.
• The user’s terminal.
• The time when the user logged in.
• Host name or IP address from where the user logged-in.

So far, we’ve seen what the output is when no options are specified; now let’s see what the options have to offer.

Who Command Options

The who command provides various options that can change the output based on the specified options, so let’s start with the

Display the Output with Header

The “-H” flag will display the header for each column in the output.

$ who -H

Output:

Display the Output in Verbose Mode

The “-a” flag will display the output with additional information that includes the info provided by the “-b“, “-d“, “-l“, “-p“, “-r“, “-t“, “-T“, and “-u” options.

$ who -a

Output:

This way, you can get all the information instead of specifying each option separately.

Display the Time of the Last System Boot

The “-b” flag will show the time of the last system boot in standard format.

$ who -b

Output:

Display the Users Idle Time

The “-u” flag will show the user’s idle time, which is basically the last time the user interacted with the terminal.

$ who -u

Output:

As you can see from the above picture, the “linuxtldr” user has been idle for 6 minutes and 16 seconds.

Display the Dead Processes

The “-d” flag will list all the dead processes under the referenced username.

$ who -d

Output:

Display the Active Processes Spawned by Init

The “-p” flag will show a list of all the processes spawned by the init.

$ who -p

Output:

Display the Total Number of Logged-In Users with their Name

The “-q” flag will show the name of all the logged-in users to the system, including their count.

$ who -q

Output:

Display the Users Terminal Status

The “-T” flag will show you the terminal status next to each username; it defines whether the user’s terminal has permission for writing messages or not.

• How to Check, Allow, or Disallow Terminal Write Access in Linux

$ who -T

Output:

The following is the list of all the possible permissions:

• “+” – The terminal is writable.
• “-” – The terminal is not writable.
• “?” – Bad line encountered.

Display the Users Login Processes

The “-l” flag will show the user login processes, or it can be stated as a list of the available terminals.

$ who -l

Output:

Display the Current Runlevel

The “-r” flag can be used to check the current runlevel of the system.

$ who -r

Output:

Display the User-Associated Information with the Current Terminal

The “-m” flag will only show user related information that is associated with the current terminal (or stdin).

$ who -m

Output:

Historical Data of the Users

As I’ve stated earlier, this command utilizes the “utmp” file to give the user information, but another file with the name “wtmp” keeps the historical data of the “utmp” file.

You can read this file using the who command to get information about the past logins.

$ who /var/log/wtmp

Output:

Identical to this, the “btmp” file keeps the record of failed logins.

$ who /var/log/btmp

Output:

So, here comes the end of this article.

If you have any questions or queries related to this topic, then feel free to ask them in the comment section.

Till then, peace!