who(1)
Display information about users currently logged in to the system.
Synopsis
who [OPTION]... [FILE]Description
The who command shows a list of all users currently logged into the system by reading the /var/run/utmp file (or a specified FILE). For each user, it displays their login name, terminal device, login time, and remote hostname if applicable.
This is useful for system administrators to monitor active sessions, check login times, and identify idle users or potential unauthorized access.
Common options
| Flag | What it does |
|---|---|
-a | Show all information (same as -b -d --login -p -r -t -T -u) |
-b | Show time of last system boot |
-d | Show dead processes |
-H | Print column headers (LOGIN, TTY, TIME, HOST) |
-l | Show login processes |
-q | Quick mode: only print usernames and count |
-r | Show runlevel |
-s | Short format: login name, terminal, login time (default) |
-T | Show terminal status (+ writable, - not writable, ? unknown) |
-u | Show idle time and process ID (PID) |
Examples
Display all currently logged-in users with basic information
whoShow logged-in users with column headers for clarity
who -HQuick listing showing only usernames and a count of total users
who -qDisplay users with their idle time and process IDs
who -uShow when the system was last booted
who -bCheck login history from the wtmp file instead of current utmp
who /var/log/wtmpDisplay information about the current user's session only
who am iShow comprehensive information including boot time, dead processes, and run level
who -a