How to View Logged-in Users and Active Processes Using the w Command in Linux

When managing a multi-user Linux server (such as a shared university mainframe or a corporate web server), system administrators need a way to quickly identify who is currently logged into the system and, more importantly, what those users are actively doing. While the standard who command will tell you who is online, the w command goes a step further by providing a comprehensive, real-time snapshot of every logged-in user and the specific processes they are currently executing.

How to Use the w Command

The w command is a core utility included in the procps package, which is installed by default on virtually every Linux distribution. To use it, simply type the command with no arguments.

w

The output is divided into two distinct sections: the system header and the user table.

Understanding the Output

The very first line of the output is the system header. It provides a quick summary of the server’s overall health, displaying the exact same information as the uptime command:

• Current Time: The local time on the server.
• Up: How long the server has been running since the last reboot.
• Users: The total number of active user sessions.
• Load Average: The system load over the last 1, 5, and 15 minutes.

Below the header is a detailed table with a row for every active session. The columns represent:

• USER: The username of the logged-in account.
• TTY: The terminal name they are connected to (e.g., pts/0 for an SSH connection, or tty1 for a physical console).
• FROM: The remote IP address or hostname the user is connecting from.
• LOGIN@: The exact time the user initiated their session.
• IDLE: How long it has been since the user typed a keystroke. If a user has been idle for hours, they may have abandoned their SSH session.
• JCPU: The total CPU time used by all processes attached to the terminal.
• PCPU: The CPU time used by the current foreground process.
• WHAT: The exact command or script the user is currently running (e.g., vim config.php or top).

Useful Command Flags

You can modify the output of the w command using a few simple flags.

• Omit the header (-h): If you are writing a bash script to parse the user data, the system header gets in the way. Use w -h to print only the user table.
• Target a specific user: If you only care about what the ‘admin’ user is doing, you can pass their username as a direct argument:

  w admin

• Short format (-s): If your terminal window is narrow and the output is wrapping poorly, use w -s to hide the JCPU, PCPU, and Login Time columns, focusing strictly on the user and their active process.