The who command in Linux tells you who is currently logged in to your system along with some other useful details. It shows a list that includes the name of the users who are currently logged in, the terminal (Line) they are using, the date and time of login, and from where they are login. You can also use it's options to display additional information about the system.The who command is a part of the GNU Core Utilities that is available on almost any Linux system. It uses the /var/run/utmp file to display information about currently logged in users.
In this article, we will explain the basics of who command, explain it's output, and use some of its command-line options.
Basic Usage of Who Command
Using the who command is very simple. You can start using the who command by simply calling it from the command line terminal.
Who Command Output Explained
Let’s explain the output of the who command shown in the above screenshot:
- First column: Shows the username of logged in users. The above example shows the two different logged in users.
- Second column: Shows how the user is logged in. The above example shows one logged in user from tty (local console) and the other one from pts (remote login).
- Third & fourth column: Shows the date and time when the user logged in.
- Fifth column: This columns shows the IP address or hostname of the system from which a user logged in remotely.
Linux Who Command Options
The who command has a lot of command line options to further expand it's usefulness. Some of the functionality of these options overlap with other commands. However, since who is part of the Core Utilities package, you can be sure of it's wide availability across different Linux and UNIX systems.
Display Date & Time of System Last Boot
With the --boot or -b options, you can display the date and time when the system was last booted.
kbuzdar@Linux-debian:~$ who -b
system boot 2020-05-12 16:08
Display Headings above the Columns
You can choose to display headings above each column in the who command output. To do so, simply use the --heading or -H option like so:
kbuzdar@Linux-debian:~$ who -H
NAME LINE TIME COMMENT
kbuzdar tty7 2020-06-13 09:58 (:0)
kbuzdar pts/1 2020-06-13 09:58 (192.168.72.1)
tin pts/2 2020-06-13 10:01 (192.168.72.1)It will help you to know what information each column is displaying.
Print System Login Processes
Using the --login or -l option, you can display the system login processes as follows:
kbuzdar@Linux-debian:~$ who -l
LOGIN tty1 2020-05-12 16:08 1162 id=tty1 Print Count and Name of All Users
Using the --count or -q option, you can print a quick list of all logged-in user names along with the total users count as follows:
kbuzdar@Linux-debian:~$ who -q
kbuzdar kbuzdar tin
# users=3Display User’s Message Status
Using either of the --message, -T or -w options, you can display the user’s message status. The message status is displayed as +,-, or ? after each user name. The status indicators shows you the users permissions for writing a message to your terminal.
kbuzdar@Linux-debian:~$ who -w
kbuzdar + tty7 2020-06-13 06:58 (:0)
kbuzdar + pts/1 2020-06-13 22:34 (192.168.72.1)
kbuzdar - pts/2 2020-06-14 07:06 (192.168.72.1)The message status has the following meaning:
+User can print messages to the terminal-User can NOT print messages to the terminal?Cannot find the terminal device (notty)
Display Idle Time of Users
The who command can display the idle time of logged in user along with other information when using the --users or -u option. Idle time indicates the time for which the user has been connected but has not performed any activity. The dot (.) indicates that the user is currently active.
kbuzdar@Linux-debian:~$ who -u
kbuzdar tty7 2020-06-13 06:58 old 36249 (:0)
kbuzdar pts/1 2020-06-13 22:34 12:48 50621 (192.168.72.1)
kbuzdar pts/2 2020-06-14 07:06 04:17 52877 (192.168.72.1)
kbuzdar pts/3 2020-06-14 11:23 . 53905 (192.168.72.1)The output also includes the PID in the second last column which is the process ID of the login shell. This comes in handy if you want to kick a user off of a Linux system.
Display Dead Processes
Using the --dead or -d option, you can display a list of dead processes. Dead processes are those processes that are ended and are not running anymore.
kbuzdar@Linux-debian:~$ who -d
pts/4 2020-06-13 22:18 49405 id=ts/4 term=0 exit=0
pts/5 2020-06-14 11:35 54165 id=ts/5 term=0 exit=04Display System’s Run Level
In Linux, a runlevel is a mode that defines the state of the system based on a certain number of services available to them.
kbuzdar@Linux-debian:~$ who -r
run-level 5 2020-05-12 13:08
Display All Information
Instead of using the separate command-line options for displaying different information, you can display all information at once using the --all or -a option.
kbuzdar@Linux-debian:~$ who -a
system boot 2020-05-12 13:08
LOGIN tty1 2020-05-12 13:08 1162 id=tty1
run-level 5 2020-05-12 13:08
kbuzdar + tty7 2020-06-13 06:58 old 36249 (:0)
kbuzdar + pts/1 2020-06-13 22:34 12:49 50621 (192.168.72.1)
kbuzdar - pts/2 2020-06-14 07:06 04:18 52877 (192.168.72.1)
pts/4 2020-06-13 22:18 49405 id=ts/4 term=0 exit=0
kbuzdar + pts/3 2020-06-14 11:23 00:01 53905 (192.168.72.1)
Save Who command Output to a File
You can save the output of who command by redirecting its output to a file. For example, the following command will save the output of who commands in a file named “samplefile”.
kbuzdar@Linux-debian:~$ who > samplefileConclusion
There you have the who command. In this article we have explained the basics of the who command and some of its command-line options. It is a simple command that lists information about who is logged in, where they logged in from, and when they logged in. Also, it displays a lot more useful information some of which we have discussed above.