who Command in Bash: List Logged-In Users

When you share a server with a team, or jump into a host to investigate something unexpected, the first question is often simple: who else is on this machine right now? The who command, part of GNU coreutils, answers exactly that. It reads from the system session records and prints the active user sessions, along with the time they logged in and where they logged in from.

This guide covers the who syntax, the flags you will actually use, and how who compares to the two other commands people confuse it with, whoami and w.

How to Use the who Command #

The basic syntax for the who command is as follows:

who [OPTION]... [ FILE | ARG1 ARG2 ]

When invoked without any option or argument, the output looks something like this:

who

root     pts/0        2026-04-12 20:10 (10.10.0.2)
linuxize pts/1        2026-04-12 20:11 (10.10.0.8)

who prints a formatted list of all users that are currently logged in to the system.

Each line contains four fields separated by one or more spaces:

• The name of the logged-in user.
• The user’s terminal.
• The time when the user logged in.
• The hostname or IP address the user is connected from. To force IP addresses instead of resolved hostnames, use the --ips option.

If you want to print the column headings, add the -H (--heading) option:

who -H

NAME     LINE         TIME             COMMENT
root     pts/0        2026-04-12 20:10 (10.10.0.2)
linuxize pts/1        2026-04-12 20:11 (10.10.0.8)

who reads session information from /var/run/utmp, the system login record used to track active sessions. If you want to read a different file, such as /var/log/wtmp for login history, pass its path as a non-option argument.

who accepts two non-option arguments. When invoked with two arguments, it prints information only about the terminal associated with the current user. The same output is displayed when the -m option is used.

You can use any two arguments, which is why the classic who am i works:

who am i
who mom love
who foo bar
who -m

Each of the commands above prints the same information:

linuxize pts/1        2026-04-12 20:11 (10.10.0.8)

who Command Options #

The who command accepts a handful of options that change what it reports. The ones you are likely to reach for in day-to-day work are below.

The -b, --boot option prints the time of the last system boot:

who -b

         system boot  2026-04-10 19:02

To list all the dead processes recorded in utmp, use the -d, --dead option:

who -d

The -r, --runlevel option shows the current runlevel on systems that still expose that information. On many modern systemd-based hosts, this output may be limited or empty, so treat it as compatibility output rather than a primary status check:

who -r

         run-level 5  2026-04-10 19:02

To get only the user names and the total count of logged-in users, use the -q, --count option:

who -q

root linuxize
# users=2

The -a, --all option combines most of the other flags and prints every field who knows about:

who -a

           system boot  2026-04-10 19:02
LOGIN      tty1         2026-04-10 19:02               673 id=tty1
           run-level 5  2026-04-10 19:02
root       - pts/0      2026-04-12 20:10   .       2212314 (10.10.0.2)
           pts/2        2026-04-11 10:19           1363538 id=ts/2  term=0 exit=0
linuxize   + pts/1      2026-04-12 20:11 01:46     2212387 (10.10.0.8)

who vs whoami vs w #

Three related commands come up in the same searches, and they answer three different questions:

• whoami prints only your own effective user name. Use it when you want to confirm the identity you are running as, especially after using sudo or su.
• who prints all users currently logged in to the system, with their terminal, login time, and source host.
• w prints the same list as who and adds a summary of system load, idle time for each session, and the command each user is currently running. Reach for w when you want context on what active users are doing, not just that they are connected.

Quick Reference #

FAQ #

What does the who command do in Linux?
who reads the /var/run/utmp session file and prints the users that are currently logged in, along with their terminal, login time, and source host. It is part of the GNU coreutils package and is present on every mainstream Linux distribution by default.

What is the difference between who and whoami?
whoami prints your own effective user name and nothing else. who lists every user currently logged in to the system. Run whoami to confirm your identity (useful after sudo or su); run who to see who else is on the machine.

What is the difference between who and w?
who shows active sessions and their login time. w shows the same list and adds system load averages, per-session idle time, and the command each user is currently running, which makes it more useful when you want to know what active users are doing.

How do I see who is logged in to a Linux system?
Run who for the list of active sessions. Add -H for column headings, -a for full details, or use w if you also want to see idle time and the command each user is running. For historical logins, use last instead.

Conclusion #

who is the quickest way to see who is currently on a Linux system and when they logged in. For a richer view that also shows per-session activity and load, pair it with w , and for login history, reach for last .

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page