Article Categories
- All Categories
-
Data Structure
-
Networking
-
RDBMS
-
Operating System
-
Java
-
MS Excel
-
iOS
-
HTML
-
CSS
-
Android
-
Python
-
C Programming
-
C++
-
C#
-
MongoDB
-
MySQL
-
Javascript
-
PHP
-
Economics & Finance
Linux who Command with Examples
The Linux who command is a fundamental system utility that displays information about users currently logged into the system. It shows login names, terminal devices, login times, and remote host information. This command is essential for system administrators to monitor active user sessions and track system access.
Basic Usage
The simplest form of the who command displays all currently logged-in users:
who
user1 pts/0 2021-12-20 10:01 (192.168.1.100) user2 pts/1 2021-12-20 10:03 (192.168.1.101) admin tty1 2021-12-20 09:45
Common Options
Display Headers (who -H)
The -H option adds column headers to make the output more readable:
who -H
NAME LINE TIME COMMENT user1 pts/0 2021-12-20 10:01 (192.168.1.100) user2 pts/1 2021-12-20 10:03 (192.168.1.101) admin tty1 2021-12-20 09:45
Show Boot Time (who -b)
Display the last system boot time:
who -b
system boot 2021-12-20 08:30
Show User Count (who -q)
Display only the usernames and total count of logged-in users:
who -q
user1 user2 admin # users = 3
Show Current User Only (who -m)
Display information only about the current user:
who -m
user1 pts/0 2021-12-20 10:01 (192.168.1.100)
Show User Activity (who -u)
Display user information with idle time and process IDs:
who -u
user1 pts/0 2021-12-20 10:01 . 1234 (192.168.1.100) user2 pts/1 2021-12-20 10:03 00:05 1567 (192.168.1.101) admin tty1 2021-12-20 09:45 . 1890
Output Format Explanation
| Column | Description |
|---|---|
| NAME | Username of the logged-in user |
| LINE | Terminal device name (tty1, pts/0, etc.) |
| TIME | Date and time when user logged in |
| IDLE | Time since last activity (. means active) |
| PID | Process ID of user's shell |
| COMMENT | Remote hostname or IP address |
Advanced Options
DNS Lookup (who --lookup)
Perform reverse DNS lookup to show hostnames instead of IP addresses:
who --lookup
user1 pts/0 2021-12-20 10:01 (workstation.example.com) user2 pts/1 2021-12-20 10:03 (laptop.example.com)
Show Run Level (who -r)
Display the current system run level:
who -r
run-level 5 2021-12-20 08:31
Practical Use Cases
System Monitoring Track who is currently using the system
Security Auditing Identify unauthorized access attempts
Resource Management Monitor active user sessions for system load
Troubleshooting Determine if multiple users are affecting system performance
Conclusion
The who command is an essential tool for Linux system administration, providing quick access to user session information. Whether monitoring active users, checking system boot times, or auditing login activity, mastering the various options of the who command helps maintain better system security and performance.
2K+ Views
