who — Show logged-in users

Linux / server log recording and analysis / who.html

Lists users currently logged in, with terminal, login time and source address.

Basic Information

What is this command?

who prints the current login sessions: user name, terminal, login time and, for remote sessions, the source address.

The data comes from /var/run/utmp, updated on login and logout. It shows only active sessions; use last for historical records.

What problems does it solve?

• Checking who is connected right now
• Inspecting source addresses for suspicious logins
• Finding which TTY a session uses
• Identifying concurrent operators before maintenance

Key features

Session list

The default run shows users, TTYs and times.

• When to use: Getting a quick view of sessions
• What you get: You immediately see who is connected from where.
• Limitations: It can look empty in containers without utmp.

Boot time

The -b option prints the last boot time.

• When to use: Confirming whether the host rebooted
• What you get: Gives a quick sense of uptime.
• Limitations: Times may be UTC, so check the time zone.

Concise output

-q or -H prints only names, or output with headers.

• When to use: Scripts that only need names
• What you get: Parsing becomes simpler.
• Limitations: Names with spaces make parsing ambiguous.

Installation and usage

Check whether it is installed

who --version

sudo apt install coreutils # Debian/Ubuntu sudo dnf install coreutils # Fedora

Real-world examples

Basic check

Show current login sessions.

who

Name-only list

Print only user names.

who -q

Last boot time

Check when the host last booted.

who -b