One of the most important features of the Linux operating system is “multi-user” software. This feature allows multiple users to use the same system resources at a time. Linux system administrator keeps a record of all the users that are logged in to the current system and using its resources.
Apart from that, the normal user can also get the number of logged-in users with the help of the Linux “who” command. This command line utility is simple to use and provides essential information about the currently logged-in users.
Quick Outline
- What is the “who” Command in Linux?
- How Does the “who” Command Work in Linux?
- How to Use the “who” Command in Linux?
- What are the Alternatives of the “who” Command in Linux?
- Conclusion
Let’s first start with the basic “who” command in Linux.
What is the “who” Command in Linux?
Linux “who” command line utility provides a list of all logged-in users of the system along with their login session information. This information contains logged-in user login names, terminal type, login time, and the hostname from which the user logged-in. This command is mostly used by the system administrator to keep a record of all users who are using this system.
After getting its basics, let’s jump into its working.
How Does the “who” Command Work in Linux?
The working of the “who” command relies on its generalized syntax that works on the supported options in this way:
who [OPTIONS] [FILE]
In the above syntax:
- The group of “[OPTIONS]” changes the “who” command output based on their names and functionalities.
- The “[FILE]” corresponds to the source file “/var/run/utmp” from where the logged-in user information is fetched.
Next, have a look at all the supported options of the “who” command along with their description:
| Options | Description |
|---|---|
| -a | It prints all the information about the currently logged-in user including the last system boot, dead processes, active processes spawned by init, last system clock change, current run level, list of logged-in users, and the status of their messages. |
| -b | It shows the time of the last system boot. |
| -d | It enlists all the dead processes. |
| -H | Print the column heading according to each of their contents. |
| -l | It prints the login process information. |
| -m | It only shows the hostname and the user associated with standard input (stdin) such as the keyboard. |
| -p | It gives a list of active processes that are spawned by init. This demon starts while the system is booting. |
| -q | It shows the name and number of logged-in users. |
| -r | It shows the system “runlevel”. |
| -s | It shows the same output as the default that contains only the logged-in username, line, and type. |
| -t | It shows the recent system clock change time. |
| -u | It shows the list of logged-in users. |
Now use the above-defined syntax and supported options of the “who” command.
How to Use the “who” Command in Linux?
To use the “who” command in Linux, execute it directly to get the logged-in user along with its login details. Moreover, it can be used to customize the default output by specifying its supported options with it.
This section shows the practical demonstration of the above-discussed scenarios with the help of the following examples.
Example 1: Default Behaviour of “who” Command
This example executes the “who” command itself without specifying any supported options to check its default behaviour:
who
Output
The default output of the “who” command shows the logged-in user having “name”, “terminal type”, “log-in date and time”, and the associated “stdin(standard input) fields:
The above same output can also be achieved with the help of its “–ips” supported option:
who --ips
Moreover, the “-s” flag concise the logged-in user’s information and provides the same output as the default of the “who” command:
who -s
Example 2: Use who Command With “-H” Flag to Print Column Headings
It can be analyzed in the above default output, that column names are not included. To display the columns along with their names in output, run the “who” command along with its “-H” supported option”
who -H
Output
Now the output of the “who” command contains columns headings according to their contents:
Example 3: Use who Command With the “-a” Flag to Get Details of the Logged-in User
This example uses the “-a” supported option of the “who” command to get the logged-in user information in detail. In addition, this example also uses the “-H” flag to print the columns’ headings:
who -a -H
Output
The below output shows the complete information of currently logged-in users having fields “NAME”, “LINE(terminal type, last boot time)”, “TIME”, “IDLE”, “PID(Process ID)”, “COMMENT”, and “EXIT”:
Example 4: Use who Command With the “-b” Flag to Get the System’s Last Boot Time
To get the last system boot time, use the “-b” flag along with the “who” command in this way:
who -b -H
In the above command the “-H” performs the same functionality as defined above.
Output
It can be observed that the “LINE” and the “TIME” column specifies the system’s last boot time:
Example 5: Use who Command With the “-d” Flag to List Dead Processes
The “who” command along with the “-d” flag lists all the dead processes in the terminal:
who -d -H
Output
It can be observed that the output shows only one dead process that is killed with an “exit” and “term(terminal type)” status 0. Moreover, the “pts/1” denotes the hidden program:
Example 6: Use who Command With the “-l” Flag to List Login Processes
This example utilizes the “-l” supported option along with the “who” command to get the list of all login processes:
who -l -H
Output
In this scenario, the output shows no login process:
Example 7: Use who Command With the “-m” Flag to Get the Hostname and the User Associated With I/O Devices
In this example, the “who” command is executed with the combination of “-m” and the “-H” supported options to retrieve the hostname from which it is logged in:
who -m -H
Output
Here, the output shows no hostname and the user-associated standard input:
Example 8: Use who Command With the “-p” Flag to Display Active Processes Spawned by INIT
After completing the system booting process, the init daemon starts many tasks automatically. These tasks include cleaning the temporary file directory “/tmp”, starting services, checking the filesystem, and much more.
To list all those active processes that are spawned by “init”, run the “who” command along with the “-p(–process)” supported options like this:
who -p -H
Output
In the output there is no active process started via the “init” daemon:
Example 9: Use who Command With the “-q” Flag to Count Logged Users
This example provides a list of logged-in user along with their total counts, using the “-q” option of the “who” command:
who -q - H
Output
Now only one user is logged into the current Linux system:
Example 10: Use who Command With the “-r” Flag to Check the Current Run-Level
This example applies the “-r” flag of the “who” command to check the current run level (state of the operating system):
who -r -H
Output
In this scenario, the “run-level” of the currently working Linux system is “5” which assists multiple users in running the same virtual machine:
Example 11: Use who Command With the “-t” Flag to Check the Last System Clock Change Time
To check when the system clock changes the time, use the “-t” options of the “who” command in this way:
who -t -H
Output
In this case, the output also contains no value because the current system’s clock did not change the time:
Example 12: Use who Command With “-T” or “-w” Flags to Get the Status of the User’s Message
In Linux, the user’s message status simply shows the permissions to write the terminal on another user. These permissions are denoted by special characters that may include the “+”, “-” and “?”.
- The “+(plus)” character means the user has permission to write to the terminal.
- The “-(hyphen)” denotes that the user does not have permission to write to another user’s terminal.
- The “?(question-mark)” specifies that the user is unable to find a terminal device.
In this example, the “-T” or the “-w” both options “who” command retrieves the user’s message status on the terminal:
who -T -H
who -w -H
Output
The execution of both the above commands shows the logged-in user’s message status “+”:
Furthermore, the same functionality can also be achieved through the “–message” or “–writable” options of the “who” command.
Example 13: Use who Command With the “-u” Flag to List Logged-in Users
The functionality of the “-u” flag is to list logged-in users along with its “IDLE” time in which the system resources are not busy:
who -u -H
Output
The output shows the currently logged-in user details including the “IDLE” time:
Example 14: Use who Command With the “–version” Flag to Check its Version
As the name implies, the “–version” option checks the version of the prepending command line utility:
who --version
Output
The below output contains the pre-installed version of the “who” command which is “8.32”:
Example 15: Use who Command With “–help” Flag to Check its Details
Lastly, for more details of the “who” command, use its “–help” option in this way:
who --help
Output
It can be analyzed that the output contains the details of the “who” command including its generalized syntax and options:
It’s enough about getting the logged-in user along with its login details using the “who” command. Now move on to other built-in Linux commands that perform the same functionality.
What are the Alternatives of the “who” Command in Linux?
Apart from the “who” command the user can also get the logged-in user details with the help of the below-stated Linux built-in commands:
- w Command
- whoami Command
- finger Command
- users Command
- top Command
- last Command
Let’s first start with the practical demonstration of the “w” command:
Alternative 1: w Command
Linux “w” command provides information about the logged-in user containing their real names, terminal type from which they logged in, and what they are currently doing. Furthermore, it also shows how much the system is being used and about the running processes.
Here is the practical demonstration of the above-defined “w” command:
w
Alternative 2: whoami Command
Linux offers another built-on command named “whoami” that exclusively displays the currently logged-in user. It is the concatenation of three strings “who” “am”, and “i”. Furthermore, It does not show any other login details of that user as the “w” and “who” commands.
Its execution without specifying any supported option shows its default behaviour:
whoami
Alternative 3: finger Command
Linux “finger ” command by default shows the information of the system’s logged-in users. This includes the login name and time, full or real name, idle time, terminal type, office location, and phone number. It is known as the “user information lookup” utility.
Here is its practical implementation:
finger
Alternative 4: users Command
The “users” command in Linux shows the names of the currently logged-in users according to the file the same as the “whoami”. It retrieves that name from the “/var/run/utmp” and the “/var/log/wtmp” files by default.
In this scenario, its execution tells that who is currently logged into the Linux system:
users
Alternative 5: top Command
In Linux, the “top” command provides the summary of the current working system. This summary includes all logged-in users, currently running processes, swap, and consumed memory, number of running tasks, and much more. It can be utilized to get the total number of logged-in users.
Here, it is executed without specifying any supported options to get the logged-in users which is “1” at this time:
top
Alternative 6: last Command
Linux “last” is another built-in command line utility that provides a list of all logged-in and out users. It keeps that record since the “/var/log/wtmp” file is created. Furthermore, it also provides the logged-in and out users, terminal types, login date and type, the IP address of the system from which they logged in, and their status whether they logged in, running, and logged out.
To list only the currently logged-in user execute the “last” command followed by the “-p” flag and “now” keyword:
last -p now
That’s all about the “who” command in Linux.
Conclusion
In Linux, the “who” is the pre-installed command line utility that provides currently logged-in users along with their additional information. This information tells that this user is logged in from which terminal type, at which time, and through which hostname, and its permissions as message status. Furthermore, it also provides a large list of supported options that retrieve the specific details about logged-in users as per requirement. This post has practically illustrated who commands in Linux.
