Linux who command tutorial

Linux who command shows who is logged on to the system. This is a useful command for a Linux system administrator because they can check how many users currently logged in the system and who they are. The Linux who command offers some options that user can use to see more details about users such as login time, terminal used and process id. However that is not the only things the who command can do. We can also use Linux who command to check when was the Linux system last booted and the current system's run level.

Linux who command examples

We already know what Linux who command can do, now it's time to see some examples. Below are the Linux who command examples run with options regularly used by system administrator.

Probably the well known Linux who command's option is the am i. When invoke who am i from a Linux command line terminal (and unix as well), the who command prints only the information about user who runs the command.

luzar@ubuntu:~$ who am i
luzar pts/0 2009-07-06 22:39 (:0.0)

When we run who with no option in Linux command line terminal, we'll get the result similar to the example below:

luzar@ubuntu:~$ who
root tty1 2009-07-06 22:06
luzar tty7 2009-07-06 19:17 (:0)
luzar pts/0 2009-07-06 21:28 (:0.0)

The example above shows two users logged in the Linux system. We can see current users in the system's username are root who logged in tty1 and luzar who's using terminal 7 (tty7), which we know it's the x-window system. The other terminal is pts/0 also by a user named luzar, which means he opened a terminal from x-window. We also see the complete date and time they logged into the Linux system in tty1, tty7 and even when they opened a command line terminal from x-window. So, when we invoke Linux who command without any option, it prints login name, terminal line, login time, and remote hostname or X display information.

Linux who -l command example:

luzar@ubuntu:~$ who -l
LOGIN tty3 2009-07-06 19:17 4439 id=3
LOGIN tty5 2009-07-06 19:17 4432 id=5
LOGIN tty4 2009-07-06 19:17 4431 id=4
LOGIN tty6 2009-07-06 19:17 4441 id=6
LOGIN tty2 2009-07-06 19:17 4438 id=2

Linux who command print system login processes. Don't get confuse with this option. When running who -l, 'who' list only the entries that correspond to processes via which the system is waiting for a user to login. The user name is always LOGIN.

Linux who -m command example:

luzar@ubuntu:~$ who -m
luzar pts/0 2009-07-06 21:28 (:0.0)

The Linux who -m command prints only hostname and user associated with stdin. It the same as running who am i command.

Linux who -q command example:

luzar@ubuntu:~$ who -q
root luzar luzar
# users=3

The Linux who -q command prints all login names and the number of users logged on. Using -q option will overrides all other options.

Linux who -r command example:

luzar@ubuntu:~$ who -r
run-level 2 2009-07-06 19:17 last=

The Linux who -r command prints system's current runlevel.

Linux who -T command example:

luzar@ubuntu:~$ who -T
root - tty1 2009-07-06 22:06
luzar + tty7 2009-07-06 19:17 (:0)
luzar + pts/0 2009-07-06 21:28 (:0.0)

After each login name, Linux who -T command prints a character indicating the user's message status, which:

  • + means allowing `write' messages.
  • - means disallowing `write' messages.
  • ? means cannot find terminal device.

Linux who -u command example:

luzar@ubuntu:~$ who -u
root tty1 2009-07-06 22:06 00:07 5465
luzar tty7 2009-07-06 19:17 old 5506 (:0)
luzar pts/0 2009-07-06 21:28 . 6509 (:0.0)

The Linux who -u command lists users logged in. After the login time, the who command prints the number of hours and minutes that the user has been idle.

  • . means the user was active in the last minute.
  • old means the user has been idle for more than 24 hours.

Linux who -b command example:

luzar@ubuntu:~$ who -b
system boot 2009-07-06 19:17

The Linux who -b command prints the date and time of last system boot.

Linux who -a command example:

luzar@ubuntu:~$ who -a
system boot 2009-07-06 19:17
run-level 2 2009-07-06 19:17 last=
LOGIN tty3 2009-07-06 19:17 4439 id=3
LOGIN tty5 2009-07-06 19:17 4432 id=5
LOGIN tty4 2009-07-06 19:17 4431 id=4
LOGIN tty6 2009-07-06 19:17 4441 id=6
LOGIN tty2 2009-07-06 19:17 4438 id=2
root - tty1 2009-07-06 22:06 00:32 5465
luzar + tty7 2009-07-06 19:17 old 5506 (:0)
luzar + pts/0 2009-07-06 22:39 . 6938 (:0.0)

The Linux who -a command is the same as invoke who -b -d --login -p -r -t -T -u.

That's all.

Back to Linux basic commands main page.

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
By submitting this form, you accept the Mollom privacy policy.