Who Linux command: Explained

who is a very basic Linux command that is easy to learn and frequently comes in handy for Linux system administrators. It is a good way to see what users are logged into the system and information about each session. In this tutorial, we will explain how to use the who command on a Linux system, and go over all of its command line options. Follow along with our examples and you will quickly master this command and understand which situations it is most useful in.

In this tutorial you will learn:

• How to use the who command and its options on Linux

Software Requirements and Linux Command Line Conventions

Category	Requirements, Conventions or Software Version Used
System	Any Linux distro
Software	who
Other	Privileged access to your Linux system as root or via the sudo command.
Conventions	# – requires given linux commands to be executed with root privileges either directly as a root user or by use of sudo command $ – requires given linux commands to be executed as a regular non-privileged user

Who Linux command: Explained

---

---

The examples below show various command line options to use with who and will explain what each of them do. Try out these Linux commands on your own system to quickly become familiar with them.

1. The most basic way to use the who command is to enter the command by itself with no further options:

   $ who
   linuxconfig tty2         2023-02-12 23:13 (tty2)
   

   The output will list information for each user logged into the system, one per line. The first piece of data we see in our output is the username linuxconfig. The second piece of data is the terminal the user is connected to – in our example, that is tty2. The third set of info 2023-02-12 23:13 is the date and time when the user’s login session started. And the fourth piece of info (tty2) is the hostname or IP address from which the user is connecting – in our case, it just shows the terminal name since we are connected locally.

2. To make the data we are looking at a little more obvious, we can add the -H (heading) option which will tell us what each column is.

   $ who -H
   NAME     LINE         TIME             COMMENT
   linuxconfig tty2         2023-02-12 23:13 (tty2)
   

3. To show all the information that who is capable of, we can append the -a (all) option. This is equivalent to running the -bdprtTu --login options and is a nice way of quickly getting all possible relevant information from the command.

   $ who -a
              system boot  2023-02-12 23:13
   linuxconfig + tty2         2023-02-12 23:13  old         1170 (tty2)
              run-level 5  2023-02-12 23:13
              pts/1        2023-02-12 23:18              2209 id=ts/1  term=0 exit=0
   

   We see information about logged in users (as shown in Example 1), when the system was booted up, what runlevel we are currently in, and some more information that will be elaborated on later.

4. To make who show the IP addresses (instead of hostnames) of all logged in users, append the --ips option:

   $ who --ips
   

5. To see when the system was last booted, we can use the -b (boot) option:
   

   ---

   ---

   $ who -b
            system boot  2023-02-12 23:13
   

   When looking for this information, you may also be interested in running the uptime command.

6. The -d (dead) option will print all dead processes to terminal:

   $ who -d
   

7. The -l or --login option will print all system login processes to terminal:

   $ who --login
   

8. The -m option will only show hostname and related information for the user associated with stdin. If entering the who command manually, then this would mean whichever account you are currently using:

   $ who -m
   

9. The -p or --process option will display active processes spawned by init.

   $ who -p
   

10. To get a quick list of all logged in users and the total number of users logged in, supply the -q option:

    $ who  -q
    linuxconfig
    # users=1
    

11. To display the current runlevel of the system, use the -r option:

    $ who -r
             run-level 5  2023-02-12 23:13
    

    For more information about runlevels and systemd targets, see our tutorial on How to check a current runlevel of your Linux system.

---

---

Closing Thoughts

In this tutorial, we saw how to use the who command and all of its options on a Linux system. who is a basic command but can be useful to quickly display essential information about users logged into the system, current runlevel, and when the system was last booted, etc. Linux administrators should remember the -a option to easily display all the relevant information from who, and remember the command’s close cousins, the w and whoami commands.