who Command in Linux

In this article, we explain the who command that is bundled in GNU coreutils package.

who is a command-line utility that prints a list of currently logged in users. It can also show the current run level, time of the last system boot, and more.

How to Use the who Command #

The basic syntax for the who command is as follows:

who [OPTION]... [ FILE | ARG1 ARG2 ]

When invoked without any option or argument, the output looks something like this:

who

root     pts/0        2020-11-17 20:10 (10.10.0.2)
linuxize    pts/1        2020-11-17 20:11 (10.10.0.8)

who will output a formatted list of all users that are currently logged on the system.

Each line contains four fields separated by one or more spaces:

• The name of the logged user.
• The user’s terminal.
• The time when the user logged in.
• The hostname or IP address from where the user is logged in. To force Ips, use the --ips option.

If you want to print the column headings, add the -H (--heading) option:

who -H

NAME      LINE         TIME             COMMENT
root      pts/0        2020-11-17 20:10 (10.10.0.2)
linuxize  pts/1        2020-11-17 20:11 (10.10.0.8)

The command pulls information about the system and who is logged in from the /var/run/utmp file. If you want to use another file, pass the file path to the command.

who accepts two non-option arguments. When invoked with two arguments the command prints information only about the terminal associated with the current user. The same output is displayed when the -m option is used.

You can use any two arguments:

who am iwho mom lovewho foo barwho -m

Each of the commands above will print the same information:

linuxize  pts/1        2020-11-17 20:11 (10.10.0.8)

who Command Options #

who accepts several options that generally are rarely used.

The -b, --boot option tells who to print the time of last system boot:

who -b

         system boot  2020-07-20 19:02

To get a list of all the dead processes use the -d, --dead option:

who -d

The -r, --runlevel option, tells who to show the current runlevel:

who -r

         run-level 5  2020-07-20 19:02

To get only the user names and the number of currently logged in users,
use the -q, --count option:

who -q

root linuxize
# users=2

The -a, --all option forces who to print all information:

who -a

           system boot  2020-07-20 19:02
LOGIN      tty1         2020-07-20 19:02               673 id=tty1
           run-level 5  2020-07-20 19:02
root       - pts/0      2020-11-17 20:10   .       2212314 (89.205.101.54)
           pts/2        2020-10-10 10:19           1363538 id=ts/2  term=0 exit=0
linuxize   + pts/1      2020-11-17 20:11 01:46     2212387 (89.205.101.54)

Conclusion #

The who command prints a list of all currently logged in users.

To get additional information about the users who are currently logged in, check the w
command.

If you have any questions, please leave a comment below.