who Command in Linux

Published on

3 min read

who Command

In this article, we explain the who command that is bundled in GNU coreutils package.

who is a command-line utility that prints a list of currently logged in users. It can also show the current run level, time of the last system boot, and more.

How to Use the who Command

The basic syntax for the who command is as follows:

who [OPTION]... [ FILE | ARG1 ARG2 ]

When invoked without any option or argument, the output looks something like this:

who
root     pts/0        2020-11-17 20:10 (10.10.0.2)
linuxize    pts/1        2020-11-17 20:11 (10.10.0.8)

who will output a formatted list of all users that are currently logged on the system.

Each line contains four fields separated by one or more spaces:

  • The name of the logged user.
  • The user’s terminal.
  • The time when the user logged in.
  • The hostname or IP address from where the user is logged in. To force Ips, use the --ips option.

If you want to print the column headings, add the -H (--heading) option:

who -H
NAME      LINE         TIME             COMMENT
root      pts/0        2020-11-17 20:10 (10.10.0.2)
linuxize  pts/1        2020-11-17 20:11 (10.10.0.8)

The command pulls information about the system and who is logged in from the /var/run/utmp file. If you want to use another file, pass the file path to the command.

who accepts two non-option arguments. When invoked with two arguments the command prints information only about the terminal associated with the current user. The same output is displayed when the -m option is used.

You can use any two arguments:

who am iwho mom lovewho foo barwho -m

Each of the commands above will print the same information:

linuxize  pts/1        2020-11-17 20:11 (10.10.0.8)

who Command Options

who accepts several options that generally are rarely used.

The -b, --boot option tells who to print the time of last system boot:

who -b
         system boot  2020-07-20 19:02

To get a list of all the dead processes use the -d, --dead option:

who -d

The -r, --runlevel option, tells who to show the current runlevel:

who -r
         run-level 5  2020-07-20 19:02

To get only the user names and the number of currently logged in users, use the -q, --count option:

who -q
root linuxize
# users=2

The -a, --all option forces who to print all information:

who -a
           system boot  2020-07-20 19:02
LOGIN      tty1         2020-07-20 19:02               673 id=tty1
           run-level 5  2020-07-20 19:02
root       - pts/0      2020-11-17 20:10   .       2212314 (89.205.101.54)
           pts/2        2020-10-10 10:19           1363538 id=ts/2  term=0 exit=0
linuxize   + pts/1      2020-11-17 20:11 01:46     2212387 (89.205.101.54)

Conclusion

The who command prints a list of all currently logged in users.

To get additional information about the users who are currently logged in, check the w command.

If you have any questions, please leave a comment below.