As a system administrator working in a multi-user environment, you should know who is logged in to your system. Luckily, the Linux OS allows you to achieve this using a simple and built-in command known as “who”. Who command is one of the GNU Core Utilities that uses the /var/log/utmp file to provide information about who is logged in to the system, which time they have logged in and from where they have logged in. It is similar to the “w” command and displays the same information along with some other information as well such as the last time when the system was booted and in which run level the system is in and a little more.
In this article, we will explain how to use the who command in Linux OS along with some of the command-line options.
Note: The commands discussed in this article have been tested on a Debian 10 Buster system.
Find who is on the system
When who command is used without any command line options, it displays the following information:
- Who is Logged in to the system
- How they have logged in (User’s Terminal)
- Date and Time of login
- From where they have logged in (Hostname or IP address of the remote server)
The above output shows that 3 users are logged in to our system. First user in the list is logged in directly to the system and the other two are logged in from the remote systems. It also displays the date and time when they logged in, and the IP addresses of the servers from where they are logged in.
Commonly used options
Here we will discuss some of the commonly used who command line options:
Display Date and time of last system boot
To display date and time of last system boot, use who command with the -b or –boot option like this:
$ who -b
Display column headings in who command
Who command without any command line option displays information in columns without any headings. It is often difficult to remember what each column is about. However, using the -h or –heading option with who command, you can display headings on the top of each column.
$ who –H
Display user’s idle time
Idle time is the time that has passed without any user’s activity during the user’s session. In order to view the idle time for each user, use who command with the -u or –users option:
$ who -u
If we see the above output, (old) in the first user’s line shows the user has been inactive since the last 24 hrs, (00:11) in the second user’s line shows that the second user has been inactive since the last 11 minutes. The (.) in the third user’s line shows the user is currently active.
Display quick count and name of current users
If you want brief information about logged in users, use who command with the -q or –count option. It will display the name and the number of users logged in to the system.
$ who -q
Display Login Processes
To display the current login processes on the system, use who command with the -l or –login option like this:
$ who -l
Display message status
You can also display the messages status of the currently logged in users. Use who command with either of -T, -w or –message option:
$ who –T
After each user’s name, you will see the message status as “+” or “–” based on whether the messaging is turned on or off respectively. In the above output, you can see that the messaging is on for the first two users while it is off for the third user.
Display Dead Processes
You can also display the dead processes in Linux. To do so, use who command with -d or –dead option like this:
$ who -d
Display current run level
Run level is a mode in Linux that the system uses for performing different functions. There are seven run levels (0-6) on the system which are categorized based on the available services.
$ who -r
To view the current run level of the system, use who command with -r option as follows:
Display All Information
All the command line options we have discussed above provide different informations. To view all the information in a single output, use who command the -a or –all option as follows:
$ who -a
Use multiple options with who command
Who command can also be used with multiple command line options. Use who command followed by multiple options using a single hyphen.
For example, to display all the information along with column headings, the command would be:
$ who -aH
Following commands can provide you some help related to who command.
To view brief information about who command, use whatis command as follows:
$ whatis who
To view who command man page, use the following command:
$ man who
Use the –help option with who command to display help.
$ who –help
To save the output of who command in a file for record purpose, type who followed by the redirector (>) symbol and the filename where you want to save the output.
$ who > file_name
The output of who command will be saved in the file rather than displaying on the terminal.
In this article, we have discussed who command along with its some of the useful command line options. You have seen that who command can do a lot more than just providing the logged in user information.
Karim Buzdar holds a degree in telecommunication engineering and holds several sysadmin certifications including CCNA RS, SCP, and ACE. As an IT engineer and technical author, he writes for various websites.