How to Use the w Command to See Who is Logged into Your Ubuntu Server

If you manage an Ubuntu Linux server that provides services to multiple developers, or if you suspect your personal machine might have been compromised, one of the very first things you should check is who is currently connected to the system. You need to know if someone else has an active SSH terminal session open, and more importantly, you need to know exactly what they are doing.

While commands like who and users will print a basic list of usernames, they lack context. The most powerful and informative command for monitoring active sessions is simply the single letter w.

This guide explains how to use the w command to instantly audit everyone currently logged into your Ubuntu system.

Running the w Command

Executing the command is as simple as it gets. Just type the letter w into your terminal and press Enter.

w

The terminal will output a dense table of information. The first line is a system summary (showing the current time, how long the server has been running, how many users are logged in, and the system load average). The real value, however, lies in the columns below.

Understanding the Output Columns

The table displays one row for every active terminal session. Here is how to read the critical data points:

• USER: The login name of the person connected. If you see “root” and you did not authorize an administrator login, you have a severe security problem.
• TTY: The name of the terminal they are using (e.g., pts/0 indicates a remote SSH connection, while tty1 indicates someone sitting physically at the keyboard).
• FROM: This is perhaps the most important column for security. It displays the remote IP address the user is connecting from. If you see an unfamiliar IP address from a foreign country, you can immediately block it.
• LOGIN@: The exact time the user initiated their session.
• IDLE: How long the user has been completely inactive. If it says “2days”, the user forgot to log out, and you should probably terminate their session to free up resources.
• WHAT: This column is the reason the w command is superior to other tools. It displays the exact command the user is currently executing at this very second. You can see if they are running a harmless top command or attempting to execute a malicious script.

Filtering by User

If you are managing a massive university server with 50 active students connected simultaneously, running the w command will flood your screen with data.

You can filter the output to only show the activity of a specific individual by adding their username after the command.

For example, to see only what the user “john” is currently doing, run:

w john

The system will filter the table, allowing you to instantly see John’s IP address, his idle time, and what script he is currently trying to execute.