s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

who

Show who is logged in now, on which terminal, since when and from where.

Level
Everyday Linux
Group
Users and groups
Needs root
No
Package
coreutils

What it does

who reads the login records (utmp) and lists the current sessions: user, terminal (tty1, pts/0 …), login time and the remote address for SSH logins.

With options it also shows the last boot time, the runlevel, or only a count. who am i (or who -m) shows only your own session.

How to write it

who [OPTION]... [FILE | ARG1 ARG2]

Options 16

Most used

-a, --all
Everything (same as -b -d --login -p -r -t -T -u).
-b, --boot
The time of the last system boot.
-H, --heading
Print column headings.
-u, --users
List users with idle time and process ID.
-q, --count
Only the names and the number of users.
-m
Only your own session (same as who am i).
-r, --runlevel
The current runlevel (target).
-s, --short
Name, terminal and time (the default).
-T, -w, --mesg, --message, --writable
Show if users accept messages (+, - or ?).
-l, --login
Show system login processes.
-p, --process
Show active processes started by init.
-d, --dead
Show dead processes.
-t, --time
Show the last system clock change.
--lookup
Try to turn addresses into DNS names.
--help
Show help.
--version
Show the version.

Examples 11

$ run as a normal user# run as root (or with sudo)

  1. 1Who is logged in?

    who
student  tty2         2026-10-25 08:10 (tty2)
admin    pts/0        2026-10-25 09:02 (192.168.122.1)

    tty = local console, pts = terminal window or SSH (with the client address).

  2. 2With headings and idle times

    who -Hu

    The IDLE column shows how long a session has been quiet.

  3. 3When did the system boot?

    who -b
         system boot  2026-10-25 07:58

    Same idea as uptime -s.

  4. 4Count the users

    who -q
student admin
# users=2

    Quick number for a status script.

  5. 5Show only my own session

    who am i
admin    pts/0        2026-10-25 09:02 (192.168.122.1)

    Shows from where you are connected.

  6. 6Check for unexpected SSH sessions (security)

    who | grep -v '192.168.122.'

    Sessions from outside your admin network deserve a look.

  7. 7Who accepts messages

    who -T

    + = write and wall messages reach the user.

  8. 8Show the current runlevel / target

    who -r

    "run-level 5" means the graphical target; 3 = multi-user (text).

  9. 9Warn everyone before a reboot

    who | wc -l; wall "Reboot in 5 minutes"

    See how many people are online, then send a message.

  10. 10List users with the DNS name of their client

    who --lookup

    Readable names instead of IPs (if reverse DNS exists).

  11. 11Compare with the history of logins

    who; last -n 5

    who = now, last = history.

Watch out

  • who only shows sessions that write login records. Some tools (like ssh host command) do not create one.

Files

/var/run/utmp
The current sessions.
/var/log/wtmp
The history (used by last).

Tips to remember

  • who = now, last = before, w = now + what they do.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man who

Open the man page (linux.die.net)man7.org