> ## Content Index
> Fetch the complete content index at: https://linuxhandbook.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# who Command Examples
- URL: https://linuxhandbook.com/who-command/
- Published: 2020-02-03T15:18:56.000Z
- Updated: 2024-04-24T11:33:25.000Z
- Description: The who command in Linux lists all logged-in users on the system. Here's how to use it to get various information about logged users.
- Author: Abhishek Prakash
- Tags: User Identification, #docs-col, #user-commands

The who command in Linux lists all logged-in users on the system. It’s pretty straightforward to use.

Just enter who in the command line and it will [show all the currently logged in users on your Linux system](https://linuxhandbook.com/linux-logged-in-users/).

```
root@localhost:~# who
root     pts/0        2020-02-03 06:48 (152.72.29.73)
john   pts/1        2020-02-03 07:02 (187.41.92.90)
jane pts/2        2020-02-03 07:02 (252.142.106.85)
```

Keep in mind that it only shows the users that are currently logged in to your system. There are other [ways to see all the users on a Linux system](https://linuxhandbook.com/linux-list-users/) like compgen.

The who command has a few options to get other specific information about logged users.

## Using who command in Linux

![Who Command](https://linuxhandbook.com/content/images/2020/06/who_command.png)

Here’s the syntax for who command:

```
who [options] [filename]
```

You have already seen what information the who command shows without any options. Let’s now see what options does it provide.

### Print the idle time of users

Along with the regular information, you can also print the idle time of the users. If a user hasn’t typed in anything for a period of time, it is reflected as the idle time.

```
who -u
```

As you can see in the output below, the user john has been idle for 2 minutes and 3 seconds.

```
root@localhost:~# who -u
root     pts/0        2020-02-03 06:48   .         10669 (152.72.29.73)
john pts/2        2020-02-03 07:02 02:03       31528 (187.41.92.90)
```

What could you do with this information? A practical use is to implement an additional security layer by automatically disconnecting users that are idle for more than a certain time.

### Display only the usernames (and their count)

With the -q option, you can only display the logged users and their count.

```
root@localhost:~# who -q
root john jane
# users=3
```

This is similar to the ‘users command’ output except for the count of logged users.

### Check if users can be sent instant message or not

Did you know that users can message each other in Linux terminal using command line tools like [mesg](https://en.wikipedia.org/wiki/Mesg?ref=linuxhandbook.com)? Of course it’s up to a user to decide if he/she wants to receive such messages or not.

You can check if a user can be sent messages or not using the **\-T option**:

```
who -T
```

In the output below, the + means yes and – means no. If you see ?, it means unknown.

```
root@localhost:~# who -T
root     - pts/0        2020-02-03 06:48 (152.72.29.73)
john + pts/2        2020-02-03 07:02 (187.41.92.90)
```

### Display information about yourself

Sort of whoami alternative. It displays the user information but only for yourself (i.e. the user associated with the current terminal).

```
who -m
```

### Check last system boot time

Somewhat similar to the [uptime command](https://linuxhandbook.com/uptime-command/), you can get information about the last time your system booted using the **\-b option** of the who command:

```
who -b
```

As you can see, my test server was last booted at 09:41 on 19th December 2019.

```
root@localhost:~# who -b
         system boot  2019-12-19 09:41
```

Print the hostname of the logged users

This could work for users on the same subnetwork. With the **–lookup option**, you can display the hostname of the logged on users.

### Bonus tip: Check past logins and bad logins information

You probably know that in [Linux filesystem hierarchy](https://linuxhandbook.com/linux-directory-structure/), stores runtime information and logs.

Who command fetches the information from the /var/run/utmp. You can specify other log files to get different information.

For example, you can get information about past logins if you use the file /var/log/wtmp.

```
root@localhost:~# who /var/log/wtmp
root     pts/0        2020-02-03 06:48 (152.72.29.73)
jane   pts/1        2020-02-03 07:02 (252.142.106.85)
john pts/2        2020-02-03 07:02 (187.41.92.90)
jane   pts/1        2020-02-03 07:12 (252.142.106.85)
jane   pts/1        2020-02-03 08:55 (252.142.106.85)
```

Similarly, you can see all the failed login attempts [using the /var/log/btmp file](https://linuxhandbook.com/utmp-wtmp-btmp/).

```
root@localhost:~# who /var/log/btmp
```

Of course, it depends on whether your system is configured to log these information.

## In the end…

There are a few more options like -H that adds a heading as the first line of the output. You can always explore them via its [man page](http://man7.org/linux/man-pages/man1/who.1.html?ref=linuxhandbook.com).

I have listed, what I consider, the important examples of the who command. I hope you like this quick little [Linux command tutorial](https://linuxhandbook.com/linux-commands/).