Linux Who Command Explained: One of the Most Common Linux Commands Function Description: Displays the information of users currently logged into the system.
Syntax: who [-Himqsw][–help][–version][am i][record file]
Additional Information: Executing this command will inform you which users are currently logged into the system. Running the who command alone will list the login accounts, the terminal used, the login time, and where they logged in from or which X display they are using.
Parameters:
-H or –heading Displays the title information for each column.
-i or -u or –idle Displays idle time. If the user has performed any action in the last minute, it will be marked with a ‘.’ symbol. If the user has not performed any action for more than 24 hours, it will display the string ‘old’.
-m This parameter has the same effect as specifying ‘am i’.
-q or –count Only displays the logged-in account names and the total number of users. www.jb51.com Linux Security Network
Extension: If you see unauthorized users logged into the system using who or w command, what should you do to kick them out?
Who Command Examples
To display information about who is using the local system node, enter:
who
It will display information similar to the following:
joe lft/0 Jun 8 08:34
To display your username, enter:
who am i
It will display information similar to the following:
george lft/0 Jun 8 08:34
To display the history of logins, logouts, system startups, and shutdowns, enter:
who /var/adm/wtmp
It will display information similar to the following:
hank lft/0 Jun 8 08:34 (ausnix5)
john lft/0 Jun 8 08:34 (JIKey)
mary lft/0 Jun 8 08:22 (machine.austin.ibm)
jan pts4 Jun 8 09:19 (puff.wisc.edu)
To display the run level of the local system node, enter:
who -r
It will display information similar to the following:
. run-level 2 Jun 8 04:15 2 0 s
To display any currently active and previously active processes generated by init, enter:
who -p
It will display information similar to the following:
srcmstr . Jun 8 04:15 old 2896
cron . Jun 8 04:15 old 4809
uprintfd . Jun 8 04:15 old 5158
To process the /var/adm/wtmp file by specifying -bdlprtTu flags, enter:
who -a /var/adm/wtmp
It will display information similar to the following:
. system boot Jun 19 10:13
. run-level 2 Jun 19 10:13
. . Jun 19 10:14 old
. . Jun 19 10:14 old
. . Jun 19 10:14 old
rc – . Jun 19 10:13 old
. . Jun 19 10:16 old
. . Jun 19 10:14 old
srcmstr – . Jun 19 10:14 old
rctcpip – . Jun 19 10:14 old
rcdce – . Jun 19 10:14 old
rccm – . Jun 19 10:15 old
dceupdt – . Jun 19 10:15 old
rcnfs – . Jun 19 10:15 old
cron – . Jun 19 10:16 old
piobe – . Jun 19 10:16 old
qdaemon – . Jun 19 10:16 old
writesrv – . Jun 19 10:16 old
uprintfd – . Jun 19 10:16 old
. . Jun 19 10:16 old
LOGIN – lft0 Jun 19 10:16 old
. . Jun 19 10:16 old
. . Jun 19 10:16 old