Who Command In Linux – Syntax, Commands, and Troubleshooting Guide 

The who command in Linux is used to show the information about the currently logged in users in the system. It provides all the details, such as usernames, login times, terminal names, and IP addresses of the connected users. System administrators or moderators usually use the who command in Linux to monitor active sessions. 

Syntax of the who Command:

The basic syntax of the who command in Linux is: 

who [OPTION]

• Running the who command without an option will display the list of logged-in users. 
• Various options will alter the output by providing additional details. 

Basic Usage of the who Command:

The most basic function of the who command in Linux is to show the list of current users. Here is an example output: 

• user1 and user2 are logged-in users.
• tty1 and pts/0 represent their terminal sessions.
• The timestamps indicate when they logged in.
• The IP address (192.168.1.10) shows a remote login session.

Common who Command Options

The who command supports several options for additional details about the logged in users, system boot time, and active processes. Here are some commonly used options. 

1. Display Logged-In Users (who)

The basic who command lists all the current users without any additional details except for terminal, login time, and remote IP (if applicable).

who

Example Output:

2. Show Detailed User Information (who -a)

The option -a displays all the possible information with user sessions, system processes, and dead processes. 

who -a

Example Output:

• The + sign indicates active sessions.
• The process IDs (PID) of logged-in users are also shown.

3. Display Login Time (who -u)

The -u flag shows the logged in users with their login time and session process ID. 

who -u

Example Output:

• The additional column shows idle time in minutes.
• The last column displays the user’s session process ID.

4. Show User Process IDs (who -p)

The -p option lists all the active user processes. 

who -p

• This output is useful for identifying user-related processes.

5. Display System Boot Time (who -b)

The -b option shows the last system boot time. 

who -b

Example Output:

• This helps track when the system was last restarted.

6. Show Dead Processes (who -d)

The – d flag lists all the terminated user processes that are not yet cleared from the system. 

who -d

Example Output:

• This is useful for debugging session issues.

Difference Between who and w Commands

Feature	who Command	w Command
Purpose	Displays currently logged-in users.	Provides detailed information about logged-in users and their activities.
Output Details	Shows username, terminal, login time, and remote IP (if applicable).	Includes user activity, terminal, login time, idle time, CPU usage, and currently running processes.
System Load Info	No system load information.	Displays system uptime and average load.
Idle Time Display	Only available with who -u.	Shows idle time directly in the output.
Running Processes	Does not display user processes.	Shows the command/process each user is running.
Usage Example	who	w
Best Used For	Checking who is logged in.	Monitoring user activity and system performance.

Using who Command with Other Commands (Piping & Redirection)

The who command in Linux is often paired with other Linux utilities such as piping and redirection to sort or format the output.

1. Filtering Output with grep

To find out the specific user’s login session: 

who | grep user1

Example Output:

This filters the who output to show only entries related to user1.

2. Counting Logged-In Users with wc

To count the total of currently logged-in users: 

who | wc -l

Example Output:

This counts the lines in the who output to display the total number of logged in users. 

3. Saving Output to a File

To save the who output for future, use: 

who > logged_users.txt

To append new output without overwriting the file:

who >> logged_users.txt

4. Sorting the Output

To display the logged-in users in alphabetical order: 

who | sort

5. Extracting Only Usernames

To display the usernames only: 

Example Output:

user1

user2

Related Read: The Linux Sleep Command: The Complete Tutorial for Beginners

Checking Last Login with who Command

The who command in Linux does not show the previous logins directly, but related commands can help display that: 

1. Using who -a to See System Boot Time and User Logins

who -a

This displays detailed login records, including system boot time.

2. Using the last Command for Previous Logins

• To check the last login time of all users:

last

• To check the last login of a specific user:

last user1

• To see only the most recent login:

last -n 1 user1

3. Checking Last Login with lastlog

The last login command shows exactly what it says, the most recent login time of all users: 

lastlog

To check a specific user’s last login:

lastlog -u user1

Troubleshooting who Command Issues

Even though it is a pretty straight forward command, here are a few troubleshooting fixes that you might need: 

1. No Output from who Command

If the who command returns no output, make sure that users are actually logged-in.
W

Alternatively, you can try running who with the -a option:
who -a

2. who Command Shows Incorrect Login Information

Check if the /var/run/utmp is corrupted:
ls -l /var/run/utmp

If missing, regenerate it by rebooting or running:
sudo touch /var/run/utmp

sudo chmod 664 /var/run/utmp

3. who Command Not Found

If the command is missing, you can re-install the util-linux package:
sudo apt install util-linux

Conclusion – Who Command In Linux

The who command in Linux displays the currently logged-in users along with the additional information to put forward a list. Using it with other important commands can help with more information as well!

Frequently asked Questions