who command in Linux

who is a command-line tool to show information about users who are currently logged in. Two other use of who command is to display time of last system boot and current run level of the system. who command comes with few useful options to display output in a specific format and to add additional information.

In this tutorial, we learn about who command.

How to use who command

The syntax of who command:

who [options] [filename]

Open your terminal using Ctrl + Alt + T on the keyboard, then type:

$ who

Output:

root     pts/0        Aug  7 23:50 (49.192.46.62)
tom      pts/1        Aug  7 23:51 (49.192.46.62)

By default who output contains five columns.

  • 1st column show the user name
  • 2nd column show how the user connected. Tty means the user is connected directly to the computer, while pts means the user is connected from remote
  • 3rd and 4th columns show the date and time
  • 5th column show the IP Address where the users are connected
who command

who discover information from utmp file which is located at /var/run/utmp.

Note: who command won’t list users that switched using su command.

who command options

who command comes with few useful options, let check those here.

1. Print time and date of last system reboot, use -b option.

$ who -b

Output:

system boot  2021-02-19 11:33

2. Display current run-level of init system, use -r option.

$ who -r

Output:

run-level 5  2021-08-08 00:56

3. Print the user names who are currently logged in and their count, use -q option

$ who -q

Output:

root tom
 users=2

4. Add the column header names, use -H option

$ who -H

Output:

NAME     LINE         TIME         COMMENT
 root     pts/0        Aug  7 23:50 (49.192.46.62)
 tom      pts/1        Aug  8 00:58 (49.192.46.62)

5. Print Idle time and PID information of each user who logged in

$ who -u -H

Output:

NAME     LINE         TIME         IDLE          PID COMMENT
 root     pts/0        Aug  7 23:50   .          3161 (49.192.46.62)
 tom      pts/1        Aug  8 00:58 00:35        4857 (49.192.46.62)

6. To print the system login process, use -l option

$ who -l

Output:

NAME     LINE         TIME         IDLE          PID COMMENT
 LOGIN    ttyS0        Aug  7 20:56               825 id=tyS0
 LOGIN    tty1         Aug  7 20:56               828 id=tty1

7. To display details of all the dead processes, use -d option

$ who -d -H

8. To print all information use -a option

$ who -a

Output:

       system boot  Aug  7 20:56
 LOGIN      ttyS0        Aug  7 20:56               825 id=tyS0
 LOGIN      tty1         Aug  7 20:56               828 id=tty1
            run-level 3  Aug  7 20:56
 root     - pts/0        Aug  7 23:50   .          3161 (49.192.46.62)
 tom      + pts/1        Aug  8 00:58 00:14        4857 (49.192.46.62)

Conclusion

In this tutorial, we learn about who command. We learned in detail how to use who command and its options.

Leave a Comment