who command in Linux

Introduction

Before we begin talking about who command in Linux, let's briefly understand – What is who command?

To see who is presently logged in, you may use the who command-line tool. Additionally, it may display system information such as the last startup time and run level. The "who" command in Linux displays information about users currently logged in.

In this tutorial, we explain the who command that is bundled in the GNU Coreutils package. We will also address a few FAQs on who command in Linux.

How to Use who Command

The basic syntax for the who command is as follows:

who [OPTION]... [ FILE | ARG1 ARG2 ]

When a function is called without any arguments or options, the result is something like this:

who

Output
root     pts/0        2020-11-17 20:10 (10.10.0.2)
vegastack    pts/1        2020-11-17 20:11 (10.10.0.8)

Who will provide a nicely structured list of all users presently logged into the system.

There are four sections per line, all separated by a space or spaces:

The name of the logged user.
The user’s terminal.
The time when the user logged in.
The Internet Protocol (IP) or hostname from which the user is accessing the system. You may compel IPs by using the --ips option.

Add the -H (--heading) option to print the column headings:

who -H

Output

NAME      LINE         TIME             COMMENT
root      pts/0        2020-11-17 20:10 (10.10.0.2)
vegastack  pts/1        2020-11-17 20:11 (10.10.0.8)

The command reads the /var/run/utmp file, which contains information about the system and the currently logged-in users. To use a different file, just provide its path in the command.

Who buys into two non-negotiable arguments. When used with two parameters, the command displays data specific to the current user's terminal. When the -m option is used, the same output is shown.

You can use any two arguments:

who am i
who mom love
who foo bar
who -m

The same information will be shown by each of the aforementioned commands:

Output
vegastack  pts/1        2022-07-09 20:11 (10.10.0.8)

`who` Command Options

who is open to a variety of rarely-used possibilities.

In order to print the time of the most recent system boot, use the -b, --boot option.

who -b

Output

         system boot  2022-07-09 19:02

The -d, --dead option may be used to acquire a list of all the dead processes:

who -d

The -r, --runlevel option specifies who should be shown the current run level:

who -r

Output
         run-level 5  2022-07-09 19:02

Use the -q, --count option to get just the usernames and the total number of users who are presently logged in:

who -q

Output

root vegastack
# users=2

Who must print all information when using the -a, --all option:

who -a

Output

           system boot  2020-07-20 19:02
LOGIN      tty1         2020-07-20 19:02               673 id=tty1
           run-level 5  2020-07-20 19:02
root       - pts/0      2020-11-17 20:10   .       2212314 (89.205.101.54)
           pts/2        2020-10-10 10:19           1363538 id=ts/2  term=0 exit=0
vegastack   + pts/1      2020-11-17 20:11 01:46     2212387 (89.205.101.54)

FAQs to who command in Linux

Can the "who" command display idle time for logged-in users?

Yes, by using the "--idle" option with the "who" command, it will also show the amount of time each user has been idle.

Is it possible to customize the output of the "who" command?

Yes, the "who" command supports various options like "--heading" to display column headers, "--count" to display the total number of users, and "--login" to only show login information.

Can the "who" command show only a specific user's information?

Yes, you can use the "--user" option followed by the username to display information about a specific user. For example, "who --user john" will show details about the user "john".

How can I show the IP addresses of logged-in users using the "who" command?

To display the IP addresses alongside other details, use the "-a" or "--all" option with the "who" command. It will show both the hostname and the IP address.

Is there a way to search for a specific user across all terminals using the "who" command?

Yes, you can use the "-u" or "--users" option with the "who" command to search for a specific user across all terminals.

Can the "who" command display the system load average?

No, the "who" command does not provide information about the system load average. It is primarily focused on displaying user-related information.

Is it possible to view the previous login history with the "who" command?

No, the "who" command only shows information about currently logged-in users. To view the login history, you can check the contents of the "/var/log/wtmp" file using specific tools like "last" or "lastlog".