Beginners Guide for Who Command in Linux

Linux TLDR
Last Updated:
Reading time: 3 minutes

The who command is a built-in Linux utility that shows a list of users who are currently logged on to the Linux system.

In this article, you will learn how to use this command and what options it has to offer (with practical examples).

Tutorial Details

DescriptionWho
Difficulty LevelLow
Root or Sudo PrivilegesNo
OS CompatibilityUbuntu, Manjaro, Fedora, etc.
Prerequisiteswho
Internet RequiredNo

Usage of the Who Command

The who command takes two arguments: one is the option, and the other is the file.

$ who [OPTION] [FILE]

If the file field is left empty, then the who command will pull the user related information from the “/var/run/utmp” file.

The following is the output when this command is executed without any options:

$ who

Output:

who command output

The above output contains four fields, followed by

  • The name of the logged-in user.
  • The user’s terminal.
  • The time when the user logged in.
  • Host name or IP address from where the user logged-in.

So far, we’ve seen what the output is when no options are specified; now let’s see what the options have to offer.

Who Command Options

The who command provides various options that can change the output based on the specified options, so let’s start with the

Display the Output with Header

The “-H” flag will display the header for each column in the output.

$ who -H

Output:

who command with header output

Display the Output in Verbose Mode

The “-a” flag will display the output with additional information that includes the info provided by the “-b“, “-d“, “-l“, “-p“, “-r“, “-t“, “-T“, and “-u” options.

$ who -a

Output:

who command output in verbose mode

This way, you can get all the information instead of specifying each option separately.

Display the Time of the Last System Boot

The “-b” flag will show the time of the last system boot in standard format.

$ who -b

Output:

who command output with last system boot time

Display the Users Idle Time

The “-u” flag will show the user’s idle time, which is basically the last time the user interacted with the terminal.

$ who -u

Output:

who command output with users idle time

As you can see from the above picture, the “linuxtldr” user has been idle for 6 minutes and 16 seconds.

Display the Dead Processes

The “-d” flag will list all the dead processes under the referenced username.

$ who -d

Output:

who command output with dead processes

Display the Active Processes Spawned by Init

The “-p” flag will show a list of all the processes spawned by the init.

$ who -p

Output:

who command output with processes spawned by init

Display the Total Number of Logged-In Users with their Name

The “-q” flag will show the name of all the logged-in users to the system, including their count.

$ who -q

Output:

Display the all the logged-in users

Display the Users Terminal Status

The “-T” flag will show you the terminal status next to each username; it defines whether the user’s terminal has permission for writing messages or not.

$ who -T

Output:

who command output with user terminal status

The following is the list of all the possible permissions:

  • +” – The terminal is writable.
  • -” – The terminal is not writable.
  • ?” – Bad line encountered.

Display the Users Login Processes

The “-l” flag will show the user login processes, or it can be stated as a list of the available terminals.

$ who -l

Output:

who command output with login processes

Display the Current Runlevel

The “-r” flag can be used to check the current runlevel of the system.

$ who -r

Output:

Print the current runlevel of the system

Display the User-Associated Information with the Current Terminal

The “-m” flag will only show user related information that is associated with the current terminal (or stdin).

$ who -m

Output:

show the user information associated with the active terminal

Historical Data of the Users

As I’ve stated earlier, this command utilizes the “utmp” file to give the user information, but another file with the name “wtmp” keeps the historical data of the “utmp” file.

You can read this file using the who command to get information about the past logins.

$ who /var/log/wtmp

Output:

Historical data for logged-in users

Identical to this, the “btmp” file keeps the record of failed logins.

$ who /var/log/btmp

Output:

Historical data of failed login

So, here comes the end of this article.

If you have any questions or queries related to this topic, then feel free to ask them in the comment section.

Till then, peace!

Join The Conversation

Users are always welcome to leave comments about the articles, whether they are questions, comments, constructive criticism, old information, or notices of typos. Please keep in mind that all comments are moderated according to our comment policy.