Linux who command - Displays who is on the system

As a system administrator, we need to ensure who is on the system on a particular time. We must keep on eye to our servers. But of course we can’t do that for 24 hours a day. On Linux system, we can use who command to see who is on the system

What is who command

who command is a tool print information about users who are currently logged in. who command only see a real user who logged in. It won’t see a user that doing su command (switch user).

How to use who command

On most Linux distribution, who command is already installed. To use it, just type who on your console. Running it without options will print a default output.

$ who

Who default view

Here’s how to read the output :

  • 1st column show the user name
  • 2nd column show how the user connected. Tty means the user is connected directly to the computer, while pts means the user is connected from remote
  • 3rd and 4th columns show the date and time
  • 5th column show the IP Address where the users are connected
    1. Using who command with options

      Who command has some options to make the custom output. Here are some samples on day-to-day usage.

      Indicate the time and date of the last reboot

      To do this, use -b options

      $ who -b

      Who last reboot

      We can see that system was boot the computer on December 21st , 2013 at 3:52 PM

      Indicate the current run-level of the init process

      With -r option, who will print a current run-level of the init process.

      $ who -r

      Who run-level information

      The output show us that the current run-level on December 21st , 2013 at 3:52 PM was run-level 2.

      Put header above every column

      Use -H option to put a header above every column

      $ who -H

      Who with header

      Print only information about current terminal

      We can use -m option to do this.

      $ who -m

      Current terminal only

      Count how many user that currently logged in

      If you have many users logged in at the same time, this -q option will help you to count them.

      $ who -q

      Count user

      Add idle time and PID information

      By default, who will not print Idle Time and PID information. To add those information, use -u option. Don’t forget to use -H option to make it easier to read.

      $ who -u -H

      Add Idle Time and PID

      The idle time contains the number of hours and minutes since last activity occurred. So 00:13 means that user leni has been idle for 13 minutes. The dot (.) sign tell us that the terminal has seen activity on the last minute. During that time, we can call it “current”. The PID is a process ID of the user’s shell.

      Show login process

      To show it, we can use -l option.

      $ who -l

      Login process

      The 1st column only show Login name which refer to System. The number 967, 971 etc on the screenshot above tell us the PID.

      Display all the information

      Using -a option will showing us all information. Here’s a sample.

      $ who -a

      All information

      Conclusion

      You will found that who command is similar with w command in some ways. Don’t be confused about why Linux has some similar command in term its functionality. You can use what you think the best for you and suit the situation you are facing. Please consult to who manual page by typing man who from your console to explore it more detail.

      About Pungki Arianto

      Pungki , currently working as a Linux / Unix administrator for a banking company. He love to work in Linux / Unix since it's fun for him. He is also interested in information technology, information security and writing.

      Author Archive Page

      Have anything to say?

      Your email address will not be published. Required fields are marked *

      All comments are subject to moderation.