who Command Examples

The who command in Linux lists all logged-in users on the system. It’s pretty straightforward to use.

Just enter who in the command line and it will show all the currently logged in users on your Linux system.

root@localhost:~# who
root     pts/0        2020-02-03 06:48 (152.72.29.73)
john   pts/1        2020-02-03 07:02 (187.41.92.90)
jane pts/2        2020-02-03 07:02 (252.142.106.85)

Keep in mind that it only shows the users that are currently logged in to your system. There are other ways to see all the users on a Linux system like compgen.

The who command has a few options to get other specific information about logged users.

Using who command in Linux

Here’s the syntax for who command:

who [options] [filename]

You have already seen what information the who command shows without any options. Let’s now see what options does it provide.

Print the idle time of users

Along with the regular information, you can also print the idle time of the users. If a user hasn’t typed in anything for a period of time, it is reflected as the idle time.

who -u

As you can see in the output below, the user john has been idle for 2 minutes and 3 seconds.

root@localhost:~# who -u
root     pts/0        2020-02-03 06:48   .         10669 (152.72.29.73)
john pts/2        2020-02-03 07:02 02:03       31528 (187.41.92.90)

What could you do with this information? A practical use is to implement an additional security layer by automatically disconnecting users that are idle for more than a certain time.

Display only the usernames (and their count)

With the -q option, you can only display the logged users and their count.

root@localhost:~# who -q
root john jane
# users=3

This is similar to the ‘users command’ output except for the count of logged users.

Check if users can be sent instant message or not

Did you know that users can message each other in Linux terminal using command line tools like mesg? Of course it’s up to a user to decide if he/she wants to receive such messages or not.

You can check if a user can be sent messages or not using the -T option:

who -T

In the output below, the + means yes and – means no. If you see ?, it means unknown.

root@localhost:~# who -T
root     - pts/0        2020-02-03 06:48 (152.72.29.73)
john + pts/2        2020-02-03 07:02 (187.41.92.90)

Display information about yourself

Sort of whoami alternative. It displays the user information but only for yourself (i.e. the user associated with the current terminal).

who -m

Check last system boot time

Somewhat similar to the uptime command, you can get information about the last time your system booted using the -b option of the who command:

who -b

As you can see, my test server was last booted at 09:41 on 19th December 2019.

root@localhost:~# who -b
         system boot  2019-12-19 09:41

Print the hostname of the logged users

This could work for users on the same subnetwork. With the –lookup option, you can display the hostname of the logged on users.

Bonus tip: Check past logins and bad logins information

You probably know that in Linux filesystem hierarchy, stores runtime information and logs.

Who command fetches the information from the /var/run/utmp. You can specify other log files to get different information.

For example, you can get information about past logins if you use the file /var/log/wtmp.

root@localhost:~# who /var/log/wtmp
root     pts/0        2020-02-03 06:48 (152.72.29.73)
jane   pts/1        2020-02-03 07:02 (252.142.106.85)
john pts/2        2020-02-03 07:02 (187.41.92.90)
jane   pts/1        2020-02-03 07:12 (252.142.106.85)
jane   pts/1        2020-02-03 08:55 (252.142.106.85)

Similarly, you can see all the failed login attempts using the /var/log/btmp file.

root@localhost:~# who /var/log/btmp

Of course, it depends on whether your system is configured to log these information.

In the end…

There are a few more options like -H that adds a heading as the first line of the output. You can always explore them via its man page.

I have listed, what I consider, the important examples of the who command. I hope you like this quick little Linux command tutorial.