Linux who Command

Display Who is Logged into the System

Command Overview

who displays information about users currently logged into the system. It shows usernames, terminal lines, login times, and remote host information. Essential for system administration, security monitoring, and understanding system usage.

Example 1: Basic User Listing

who
jsmith tty1 2025-11-11 08:30 mjones pts/0 2025-11-11 09:15 (192.168.1.100) admin pts/1 2025-11-11 10:22 (10.0.0.50)

Shows all currently logged-in users with their terminal and login time. Remote connections show IP address in parentheses.

Example 2: Show Current User Only

who am i
jsmith pts/2 2025-11-11 14:30 (192.168.1.25)

Displays information only about the current terminal session. Useful in scripts to identify the running user.

Example 3: Show Column Headers

who -H
NAME LINE TIME COMMENT jsmith tty1 2025-11-11 08:30 mjones pts/0 2025-11-11 09:15 (192.168.1.100)

The -H option adds column headers for clarity. Helpful for documentation and understanding output format.

Example 4: Show Idle Time

who -u
jsmith tty1 2025-11-11 08:30 . 1234 mjones pts/0 2025-11-11 09:15 01:30 5678 (192.168.1.100) admin pts/1 2025-11-11 10:22 00:05 9012 (10.0.0.50)

Shows idle time and process ID. Dot (.) means active within last minute. Format is HH:MM for idle time.

Example 5: Show System Boot Time

who -b
system boot 2025-11-10 06:15

Displays when the system was last booted. Useful for determining uptime and last restart.

Example 6: Show Run Level

who -r
run-level 5 2025-11-10 06:15

Shows current system run level. Run level 5 typically means graphical multi-user mode.

Example 7: Count Logged-in Users

who -q
jsmith mjones admin # users=3

Quick count format showing usernames and total count. Fastest way to see how many users are logged in.

Example 8: Show All Information

who -a
system boot 2025-11-10 06:15 run-level 5 2025-11-10 06:15 LOGIN tty1 2025-11-10 06:15 1234 id=1 jsmith + tty1 2025-11-11 08:30 old 1234 mjones + pts/0 2025-11-11 09:15 01:30 5678 (192.168.1.100)

Comprehensive output including boot time, run level, dead processes, and login processes. Most detailed view available.

Example 9: Show Only Users on Specific Terminal

who | grep pts/0
mjones pts/0 2025-11-11 09:15 (192.168.1.100)

Filters output to show only users on a specific terminal. Useful for checking specific connection types.

Example 10: Security Check - List Remote Connections

who | grep -E '\([0-9]+\.'
mjones pts/0 2025-11-11 09:15 (192.168.1.100) admin pts/1 2025-11-11 10:22 (10.0.0.50)

Shows only remote connections by filtering for IP addresses. Important for security auditing and monitoring external access.

Additional Information

Common Options

Related Commands

Security Tip: Regularly run who or w to monitor for unauthorized logins. Combine with last for historical login analysis.