When managing a multi-user Ubuntu Linux system, especially a remote server accessed via SSH, it is critical to know exactly who is actively connected to the machine at any given moment. Whether you are preparing to perform a system reboot and need to warn active users, or you suspect unauthorized access, the command line provides several tools for user auditing. The simplest and most direct of these tools is the who command.
What Does the who Command Do?
The who command reads the system’s active session records (specifically, a file located at /var/run/utmp) and prints a clean, formatted list of every user currently logged into the system. Unlike complex monitoring tools like top or htop, the who command does not monitor CPU usage or running processes; it simply tells you exactly who is sitting at a terminal or connected remotely right now.
How to Use the Basic who Command
Using the command is incredibly straightforward.
- Open your terminal or connect to your server via SSH.
- Type the following three letters:
who - Press Enter.
The terminal will output a list of active sessions. A standard line of output looks like this:
johndoe pts/0 2023-10-26 14:30 (192.168.1.50)
Understanding the Output
- johndoe: The username of the account that is logged in.
- pts/0: The terminal line or pseudo-terminal they are using. (
ttyusually means they are sitting physically at the machine, whileptsmeans they are connected remotely via SSH or a terminal emulator window). - 2023-10-26 14:30: The exact date and time the user initiated the login session.
- (192.168.1.50): The IP address from which the user connected. (If they are sitting at the physical machine, this space may be blank or show the local hostname).
Advanced Usage with Flags
While the basic output is useful, you can add flags to extract more specific information.
Include System Boot Time
If you add the -b flag, the command will ignore the user list and instead print the exact date and time the Linux system was last booted up.
who -b
Include Idle Time (The -H flag)
By default, the who command does not print column headers, making it slightly difficult for beginners to read. Adding the -H (Heading) flag adds clear labels to the top of the columns.
who -H
The “Am I” Trick
If you are logged into a server using a shared generic account (like “admin” or “root”), you might forget your original context. You can ask the system to identify your specific, current session by typing two words:
who am i
The system will output only the single line from the utmp file that corresponds to your exact current terminal window, ignoring all other active users.