How to Use the Who Command in Linux

By . in Desktop. Updated on .

The who command in Linux is a command-line utility that displays information about users who are currently logged in to the system. It provides a quick overview of which users are logged in and what they are doing.

The output of the who command typically includes the username, terminal name (tty/pts), date and time of login, and remote host name of the user if the login is from a remote location.

General syntax for who command:

$ who [OPTIONS...]
1. Show all users’ information
who -a

The -a option allows you to see all the details of each user logged into the current system.

Example:

Here’s a sample output of what the who -a command might show:

system boot  2023-07-09 08:15
run-level 5  2023-07-09 08:15
LOGIN        tty1         2023-07-09 08:15              420 id=tty1
username  +  pts/0        2023-07-09 10:18   .         1025 (192.168.1.10)

In this example:

  • system boot 2023-07-09 08:15 shows when the system was last booted.
  • run-level 5 2023-07-09 08:15 indicates the system’s current run level and when it was last changed. Run level 5 typically means the system is in multi-user mode with a graphical user interface.
  • LOGIN tty1 2023-07-09 08:15 420 id=tty1 shows a login process that was started on terminal tty1 at the specified time. The number 420 is the process ID of the login process, and id=tty1 is an identifier for the terminal.
  • username + pts/0 2023-07-09 10:18 . 1025 (192.168.1.10) shows a user named username logged in on pseudo terminal pts/0 at the specified time. The + sign indicates that the user is allowed to receive messages. The dot (.) means the user is active. The number 1025 is the process ID of the user’s shell, and (192.168.1.10) is the IP address of the remote host from which the user logged in.
2. Show system’s last boot time
who -b

Use the who command with the -b option to print the last boot time of the system.

Example:

Here is a sample output of the who -b command:

system boot  2023-07-09 08:17

In this example:

  • system boot indicates that the information provided is about the system boot time.
  • 2023-07-09 08:17 is the date and time when the system was last booted.
3. List all logged in users
who -q

This command displays only the names of the logged-in users and the total number of logged-in users. The -q option stands for “quick”.

Example:

Here’s a sample output of the who -q command:

username1 username2 username3
# users=3

In this example:

  • username1, username2, and username3 are the names of the users currently logged in to the system.
  • # users=3 indicates the total number of users currently logged in to the system.
4. Check user’s write permission
who -T

The who -t command in Linux is used to display the last system boot time. The -t option stands for “time”.

Example:

Let’s type the who -T command to display user statuses in the terminal.

system boot  2023-07-09 08:15

In this example:

  • system boot indicates that this is the time the system last booted.
  • 2023-07-09 08:15 is the date and time of the last system boot.
5. Show all dead processes
who -d

The who -d command in Linux is used to show the users who are logged in, but also includes the processes that were initiated by users but are currently in a “dead” state. These are processes that were started by logged-in users but are no longer attached to a user session.

Example:

Typing the who command with the -d option to show details of all dead processes.

username  pts/0        2023-07-09 10:18 (192.168.1.10)
username  pts/1        2023-07-09 10:20 .         12345

In this example:

  • The first line is a regular user session, similar to the output of the who command.
  • The second line represents a “dead” process. The . in the fourth column indicates that the process is no longer attached to a user session. The number 12345 at the end is the process ID (PID) of the dead process.
6. Show information about current user
who -m

The who -m command in Linux is used to show information about the current terminal. The -m option stands for “mesg”, which is short for “message”. It shows the information related to the current terminal only.

Example:

Here is a sample output of the who -m command:

username  pts/0        2023-07-09 10:18

In this example:

  • username is the name of the logged-in user.
  • pts/0 is the terminal name. The pts stands for pseudo terminal slave. If the user is logged in via a physical terminal, this would be tty (teletypewriter).
  • 2023-07-09 10:18 is the date and time the user logged in.
7. Show all active processes spawned by INIT process
who -p

The who -p command shows the active processes spawned by the init system. However, this option is not universally available on all Unix-like operating systems.

Example:

On systems where it is available, it might show output similar to this:

run-level 3  2023-07-09 10:18

n this example:

  • run-level 3 indicates the current run level of the system. Run levels are a state or mode that a Unix-like operating system like Linux operates in. Different run levels serve different purposes and are denoted by numbers. For instance, run level 3 typically means that the system is in multi-user mode with networking (the exact meaning can vary a bit depending on the system).
  • 2023-07-09 10:18 is the date and time when the current run level was set.
8. Show current runlevel
who -r

The who -r command in Linux displays the current runlevel of the system. The runlevel is a state of the system that defines what services and resources are available to users.

Example:

run-level 3  2023-07-09 10:18

In this example:

  • run-level 3 indicates the current runlevel of the system. In this case, it’s 3, which typically means that the system is in multi-user mode with networking (this can vary slightly depending on the specific Linux distribution).
  • 2023-07-09 10:18 is the date and time when the current runlevel was last changed.
More Linux commands:
Directory Operations rmdir · cd · pwd · exa · ls
File Operations cat · cp · dd · less · touch · ln · rename · more · head
File System Operations chown · mkfs · locate
Networking ping · curl · wget · iptables · mtr
Search and Text Processing find · grep · sed · whatis · ripgrep · fd · tldr
System Information and Management env · history · top · who · htop · glances · lsof
User and Session Management screen · su · sudo · open
WebsiteFacebookTwitterInstagramPinterestLinkedInGoogle+YoutubeRedditDribbbleBehanceGithubCodePenWhatsappEmail