How to view current logged-in users with who
How to View Current Logged-in Users with Who
Table of Contents
1. [Introduction](#introduction)
2. [Prerequisites](#prerequisites)
3. [Understanding the Who Command](#understanding-the-who-command)
4. [Basic Usage of Who Command](#basic-usage-of-who-command)
5. [Who Command Options and Flags](#who-command-options-and-flags)
6. [Practical Examples and Use Cases](#practical-examples-and-use-cases)
7. [Related Commands](#related-commands)
8. [Advanced Usage Scenarios](#advanced-usage-scenarios)
9. [Troubleshooting Common Issues](#troubleshooting-common-issues)
10. [Best Practices and Security Considerations](#best-practices-and-security-considerations)
11. [Conclusion](#conclusion)
Introduction
The `who` command is a fundamental Unix and Linux utility that provides essential information about users currently logged into a system. Whether you're a system administrator monitoring user activity, a developer working on a shared server, or simply curious about who else is using your system, the `who` command is an indispensable tool for user management and system monitoring.
In this comprehensive guide, you'll learn everything about using the `who` command effectively, from basic usage to advanced scenarios. We'll explore various command options, practical examples, troubleshooting techniques, and best practices that will help you master this essential system administration tool.
Understanding who is currently logged into your system is crucial for security monitoring, resource management, and maintaining system integrity. The `who` command provides real-time information about active user sessions, including login times, terminal information, and connection details.
Prerequisites
Before diving into the `who` command, ensure you have the following:
System Requirements
- A Unix-like operating system (Linux, macOS, BSD, Solaris, etc.)
- Terminal or command-line access
- Basic familiarity with command-line interface
Knowledge Prerequisites
- Understanding of basic Linux/Unix commands
- Familiarity with user accounts and login processes
- Basic knowledge of terminal concepts
Access Requirements
- User-level access to the system (no special privileges required for basic usage)
- Some advanced features may require administrative privileges
Understanding the Who Command
What is the Who Command?
The `who` command is a standard Unix utility that displays information about users who are currently logged into the system. It reads from system files (typically `/var/run/utmp` or `/var/log/wtmp`) to gather information about active user sessions.
How Who Works
When you execute the `who` command, it:
1. Reads system login records from utmp files
2. Processes active session data to identify current users
3. Displays formatted output showing user information
4. Updates in real-time to reflect current system state
Information Provided by Who
The `who` command typically displays:
- Username: The login name of the user
- Terminal: The terminal or pseudo-terminal being used
- Login time: When the user logged in
- Remote host: For remote connections, the source IP or hostname
- Process ID: In some cases, the process ID of the login shell
Basic Usage of Who Command
Simple Who Command
The most basic usage of the `who` command requires no arguments:
```bash
who
```
Example output:
```
john pts/0 2024-01-15 09:30 (192.168.1.100)
sarah pts/1 2024-01-15 10:15 (workstation.local)
admin tty1 2024-01-15 08:00
```
Understanding the Output Format
Let's break down what each column represents:
1. Column 1 (Username): `john`, `sarah`, `admin`
- The login name of the user
2. Column 2 (Terminal): `pts/0`, `pts/1`, `tty1`
- `pts/X`: Pseudo-terminal (typically SSH or terminal emulator)
- `ttyX`: Physical terminal or console
3. Column 3 (Date and Time): `2024-01-15 09:30`
- When the user logged in
4. Column 4 (Remote Host): `(192.168.1.100)`
- Source of remote connections (in parentheses)
- Local logins may not show this information
Who Command Options and Flags
Common Options
Display All Information (-a)
```bash
who -a
```
This displays all available information, including:
- Boot time
- Dead processes
- Login processes
- Active users
- Run level information
Example output:
```bash
system boot 2024-01-15 07:45
run-level 5 2024-01-15 07:45
LOGIN tty1 2024-01-15 07:45 796 id=1
john + pts/0 2024-01-15 09:30 . 1234 (192.168.1.100)
sarah + pts/1 2024-01-15 10:15 . 1456 (workstation.local)
```
Show Boot Time (-b)
```bash
who -b
```
Displays when the system was last booted:
```bash
system boot 2024-01-15 07:45
```
Show Dead Processes (-d)
```bash
who -d
```
Lists processes that have died but haven't been cleaned up by their parent processes.
Show System Login Processes (-l)
```bash
who -l
```
Displays system login processes:
```bash
LOGIN tty1 2024-01-15 07:45 796 id=1
```
Show Current Runlevel (-r)
```bash
who -r
```
Displays the current system runlevel:
```bash
run-level 5 2024-01-15 07:45
```
Show Time of Last System Clock Change (-t)
```bash
who -t
```
Shows when the system clock was last changed.
Show Only User Names and Count (-q)
```bash
who -q
```
Displays a quick summary with usernames and total count:
```bash
john sarah admin
users = 3
```
Show Own Username (-m or am i)
```bash
who -m
or
who am i
```
Displays information about your own login session:
```bash
john pts/0 2024-01-15 09:30 (192.168.1.100)
```
Advanced Options
Include Idle Time (-u)
```bash
who -u
```
Shows how long each user has been idle:
```bash
john pts/0 2024-01-15 09:30 . 1234 (192.168.1.100)
sarah pts/1 2024-01-15 10:15 00:05 1456 (workstation.local)
admin tty1 2024-01-15 08:00 02:30 796
```
The idle time appears after the login time:
- `.` means the user is currently active
- `00:05` means idle for 5 minutes
- `02:30` means idle for 2 hours and 30 minutes
Show Process IDs (-p)
```bash
who -p
```
Includes process IDs in the output.
Include Message Status (-T or -w)
```bash
who -T
or
who -w
```
Shows whether users can receive messages via `write` or `talk`:
```bash
john + pts/0 2024-01-15 09:30 (192.168.1.100)
sarah - pts/1 2024-01-15 10:15 (workstation.local)
admin ? tty1 2024-01-15 08:00
```
- `+` means the user can receive messages
- `-` means messages are disabled
- `?` means message status is unknown
Practical Examples and Use Cases
Example 1: System Administrator Monitoring
As a system administrator, you need to monitor who is currently accessing your server:
```bash
Check all current users
who
Get detailed information including idle times
who -u
Quick count of logged-in users
who -q
```
Use case: Monitoring server access during maintenance windows or security audits.
Example 2: Security Monitoring
Check for unauthorized access or unusual login patterns:
```bash
Show all login information
who -a
Focus on active users with message status
who -T -u
```
Security tip: Look for:
- Unfamiliar usernames
- Logins from unexpected IP addresses
- Multiple sessions from the same user
- Logins at unusual times
Example 3: Resource Management
Before performing system maintenance, check user activity:
```bash
Check who's logged in and their idle time
who -u
Verify system boot time
who -b
```
This helps determine if users are actively working and when the system was last restarted.
Example 4: Troubleshooting User Issues
When a user reports login problems, verify their session:
```bash
Check if user is actually logged in
who | grep username
Get detailed session information
who -a | grep username
```
Example 5: Automated Monitoring Scripts
Create a script to monitor user logins:
```bash
#!/bin/bash
Script: monitor_users.sh
echo "=== Current System Users ==="
echo "Date: $(date)"
echo "Boot time: $(who -b)"
echo ""
echo "Active users:"
who -u
echo ""
echo "Total users: $(who -q | tail -1)"
```
Related Commands
W Command
The `w` command provides more detailed information than `who`:
```bash
w
```
Example output:
```bash
11:30:45 up 3:45, 3 users, load average: 0.15, 0.10, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
john pts/0 192.168.1.100 09:30 0.00s 0.12s 0.01s -bash
sarah pts/1 workstation 10:15 5:00 0.08s 0.08s vim file.txt
admin tty1 - 08:00 2:30m 0.05s 0.05s -bash
```
Users Command
The `users` command shows a simple list of logged-in users:
```bash
users
```
Output:
```bash
admin john sarah
```
Last Command
The `last` command shows login history:
```bash
last
```
This displays recent logins and logouts, useful for tracking user activity over time.
Finger Command
If available, `finger` provides detailed user information:
```bash
finger
finger username
```
Advanced Usage Scenarios
Combining Who with Other Commands
Count Active Users
```bash
who | wc -l
```
This counts the number of currently logged-in users.
Monitor Specific Users
```bash
who | grep "john\|sarah"
```
Filter output to show only specific users.
Check for Remote Connections
```bash
who | grep "("
```
Shows only users connected remotely (those with hostnames in parentheses).
Sort Users by Login Time
```bash
who | sort -k3,4
```
Sorts the output by login date and time.
Scripting with Who
Alert Script for Multiple Logins
```bash
#!/bin/bash
Alert if more than 5 users are logged in
USER_COUNT=$(who | wc -l)
THRESHOLD=5
if [ $USER_COUNT -gt $THRESHOLD ]; then
echo "WARNING: $USER_COUNT users currently logged in (threshold: $THRESHOLD)"
who
fi
```
User Session Duration
```bash
#!/bin/bash
Calculate how long each user has been logged in
who -u | while read user tty date time idle pid host; do
if [ "$user" != "" ] && [ "$date" != "" ]; then
login_time="$date $time"
echo "User: $user, Logged in: $login_time, Idle: $idle"
fi
done
```
Monitoring Scripts
Continuous User Monitoring
```bash
#!/bin/bash
Continuously monitor user logins
while true; do
clear
echo "=== User Monitor - $(date) ==="
echo ""
who -u
echo ""
echo "Refreshing in 30 seconds..."
sleep 30
done
```
Troubleshooting Common Issues
Issue 1: Who Command Not Found
Problem: Command not found error when running `who`.
Solution:
```bash
Check if who is installed
which who
On some systems, try full path
/usr/bin/who
Install if missing (Ubuntu/Debian)
sudo apt-get install coreutils
Install if missing (CentOS/RHEL)
sudo yum install coreutils
```
Issue 2: Empty or Incomplete Output
Problem: `who` command returns no output or incomplete information.
Possible causes and solutions:
1. Check utmp file permissions:
```bash
ls -la /var/run/utmp
ls -la /var/log/wtmp
```
2. Verify file existence:
```bash
Common locations for utmp files
ls -la /var/run/utmp /var/log/utmp /etc/utmp
```
3. Check if you're in a container:
```bash
In some containers, utmp might not be properly maintained
cat /proc/1/cgroup
```
Issue 3: Incorrect Time Display
Problem: Login times appear incorrect or in wrong timezone.
Solutions:
```bash
Check system timezone
timedatectl status
Set correct timezone
sudo timedatectl set-timezone America/New_York
Verify date command
date
```
Issue 4: Missing Remote Host Information
Problem: Remote connections don't show hostname or IP address.
Causes:
- DNS resolution issues
- Network configuration problems
- SSH configuration settings
Solutions:
```bash
Check SSH configuration
grep -i "UseDNS" /etc/ssh/sshd_config
Test DNS resolution
nslookup client_ip_address
Check network connectivity
ping client_hostname
```
Issue 5: Permission Denied Errors
Problem: Permission denied when trying to access user information.
Solutions:
```bash
Check file permissions
ls -la /var/run/utmp
Add user to appropriate group (if needed)
sudo usermod -a -G utmp username
Run with sudo if necessary (for system files)
sudo who -a
```
Best Practices and Security Considerations
Security Best Practices
Regular Monitoring
1. Schedule regular checks:
```bash
Add to crontab for hourly user monitoring
0 /usr/bin/who -u >> /var/log/user_activity.log
```
2. Monitor for suspicious activity:
- Unusual login times
- Multiple concurrent sessions
- Logins from unexpected locations
- Accounts that should be inactive
Access Control
1. Limit who can view user information:
```bash
Restrict access to utmp files if needed
sudo chmod 640 /var/run/utmp
sudo chgrp utmp /var/run/utmp
```
2. Monitor privileged accounts:
```bash
Focus on administrative accounts
who | grep -E "(root|admin|sudo)"
```
Performance Considerations
Efficient Usage
1. Use appropriate options:
```bash
For quick counts, use -q instead of full output
who -q
For specific information, use targeted options
who -b # Just boot time
who -r # Just runlevel
```
2. Combine with other tools efficiently:
```bash
Efficient user counting
who | wc -l
Quick user list
users
```
Automation Best Practices
Script Guidelines
1. Error handling:
```bash
#!/bin/bash
if ! command -v who &> /dev/null; then
echo "Error: who command not found"
exit 1
fi
Check if utmp file exists
if [ ! -r /var/run/utmp ]; then
echo "Warning: Cannot read user login information"
exit 1
fi
```
2. Logging and alerting:
```bash
#!/bin/bash
Log user activity with timestamps
{
echo "=== $(date) ==="
who -u
echo ""
} >> /var/log/custom_user_monitor.log
```
Integration with System Monitoring
Combining with Other Tools
1. System monitoring integration:
```bash
Combine who with system load information
echo "Users: $(who | wc -l), Load: $(uptime | cut -d',' -f4-)"
```
2. Log analysis:
```bash
Correlate with system logs
who -u > /tmp/current_users.txt
tail -f /var/log/auth.log | grep -f /tmp/current_users.txt
```
Conclusion
The `who` command is an essential tool for system administrators, developers, and anyone working with multi-user Unix and Linux systems. Throughout this comprehensive guide, we've explored:
Key Takeaways
1. Basic Usage: The `who` command provides immediate visibility into current user sessions with simple, readable output.
2. Advanced Features: Various command-line options allow for detailed system monitoring, including idle times, process IDs, and system status information.
3. Practical Applications: From security monitoring to resource management, the `who` command serves multiple critical functions in system administration.
4. Integration Capabilities: The command works effectively with other Unix tools and can be integrated into monitoring scripts and automated systems.
Best Practices Summary
- Regular Monitoring: Implement routine checks for user activity
- Security Awareness: Watch for unusual login patterns or unauthorized access
- Efficient Usage: Choose appropriate command options for specific needs
- Script Integration: Combine with other tools for comprehensive monitoring
Next Steps
To further enhance your system monitoring capabilities:
1. Explore Related Commands: Learn `w`, `last`, `users`, and `finger` for comprehensive user monitoring
2. Implement Monitoring Scripts: Create automated solutions for your specific environment
3. Study Log Files: Understand how login information is stored and managed
4. Security Hardening: Implement additional security measures based on user activity patterns
The `who` command, while simple in concept, provides powerful capabilities for understanding and monitoring user activity on Unix and Linux systems. By mastering its various options and integrating it into your system administration toolkit, you'll be better equipped to maintain secure, efficient, and well-monitored computing environments.
Whether you're troubleshooting user issues, conducting security audits, or simply keeping track of system usage, the `who` command remains an indispensable tool in the Unix administrator's arsenal. Practice with the examples provided, experiment with different options, and incorporate this knowledge into your daily system management routines for optimal results.