The who command in Linux tells you who is currently logged in to your system along with some other useful details. It shows a list that includes the name of the users who are currently logged in, the terminal (Line) they are using, the date and time of login, and from where they are login. You can also use it's options to display additional information about the system.The who command is a part of the GNU Core Utilities that is available on almost any Linux system. It uses the /var/run/utmp file to display information about currently logged in users.

In this article, we will explain the basics of who command, explain it's output, and use some of its command-line options.

Basic Usage of Who Command

Using the who command is very simple. You can start using the who command by simply calling it from the command line terminal.

screenshot of a linux who command example

Who Command Output Explained

Let’s explain the output of the who command shown in the above screenshot:

  • First column: Shows the username of logged in users. The above example shows the two different logged in users.
  • Second column: Shows how the user is logged in. The above example shows one logged in user from tty (local console) and the other one from pts (remote login).
  • Third & fourth column: Shows the date and time when the user logged in.
  • Fifth column: This columns shows the IP address or hostname of the system from which a user logged in remotely.

Linux Who Command Options

The who command has a lot of command line options to further expand it's usefulness. Some of the functionality of these options overlap with other commands. However, since who is part of the Core Utilities package, you can be sure of it's wide availability across different Linux and UNIX systems.

Display Date & Time of System Last Boot

With the --boot or -b options, you can display the date and time when the system was last booted.

kbuzda[email protected]:~$ who -b
         system boot  2020-05-12 16:08

Display Headings above the Columns

You can choose to display headings above each column in the who command output. To do so, simply use the --heading or -H option like so:

[email protected]:~$ who -H
NAME     LINE         TIME             COMMENT
kbuzdar  tty7         2020-06-13 09:58 (:0)
kbuzdar  pts/1        2020-06-13 09:58 (
tin      pts/2        2020-06-13 10:01 (

It will help you to know what information each column is displaying.

Print System Login Processes

Using the --login or -l option, you can display the system login processes as follows:

[email protected]:~$ who -l
LOGIN    tty1         2020-05-12 16:08              1162 id=tty1 

Print Count and Name of All Users

Using the --count or -q option, you can print a quick list of all logged-in user names along with the total users count as follows:

[email protected]:~$ who -q
kbuzdar kbuzdar tin
# users=3

Display User’s Message Status

Using either of the --message, -T or -w options, you can display the user’s message status. The message status is displayed as +,-, or ? after each user name. The status indicators shows you the users permissions for writing a message to your terminal.

[email protected]:~$ who -w
kbuzdar  + tty7         2020-06-13 06:58 (:0)
kbuzdar  + pts/1        2020-06-13 22:34 (
kbuzdar  - pts/2        2020-06-14 07:06 (

The message status has the following meaning:

  • + User can print messages to the terminal
  • - User can NOT print messages to the terminal
  • ? Cannot find the terminal device (notty)

Display Idle Time of Users

The who command can display the idle time of logged in user along with other information when using the --users or -u option. Idle time indicates the time for which the user has been connected but has not performed any activity. The dot (.) indicates that the user is currently active.

[email protected]:~$ who -u
kbuzdar  tty7         2020-06-13 06:58  old           36249 (:0)
kbuzdar  pts/1        2020-06-13 22:34 12:48       50621 (
kbuzdar  pts/2        2020-06-14 07:06 04:17       52877 (
kbuzdar  pts/3        2020-06-14 11:23   .         53905 (

The output also includes the PID in the second last column which is the process ID of the login shell. This comes in handy if you want to kick a user off of a Linux system.

Display Dead Processes

Using the --dead or -d option, you can display a list of dead processes. Dead processes are those processes that are ended and are not running anymore.

[email protected]:~$ who -d
         pts/4        2020-06-13 22:18             49405 id=ts/4  term=0 exit=0
         pts/5        2020-06-14 11:35             54165 id=ts/5  term=0 exit=04

Display System’s Run Level

In Linux, a runlevel is a mode that defines the state of the system based on a certain number of services available to them.

kbuzda[email protected]:~$ who -r
         run-level 5  2020-05-12 13:08

Display All Information

Instead of using the separate command-line options for displaying different information, you can display all information at once using the --all or -a option.

[email protected]:~$ who -a
                    system boot 2020-05-12 13:08
LOGIN       tty1               2020-05-12 13:08                  1162   id=tty1
                    run-level 5   2020-05-12 13:08
kbuzdar     +  tty7            2020-06-13 06:58   old         36249   (:0)
kbuzdar     +  pts/1          2020-06-13 22:34  12:49       50621   (
kbuzdar     -  pts/2           2020-06-14 07:06  04:18       52877   (
                     pts/4           2020-06-13 22:18                  49405    id=ts/4  term=0 exit=0
kbuzdar     +  pts/3          2020-06-14 11:23  00:01       53905    (

Save Who command Output to a File

You can save the output of who command by redirecting its output to a file. For example, the following command will save the output of who commands in a file named “samplefile”.

[email protected]:~$ who > samplefile


There you have the who command. In this article we have explained the basics of the who command and some of its command-line options. It is a simple command that lists information about who is logged in, where they logged in from, and when they logged in. Also, it displays a lot more useful information some of which we have discussed above.