How to List All Logged-In Users in Ubuntu

If you are managing a multi-user Ubuntu server, it is critical to know who is currently logged into the system. Whether you are about to initiate a system reboot and need to warn active users, or you suspect unauthorized access and want to audit current sessions, Ubuntu provides built-in command-line tools to instantly reveal active connections.

This guide explains how to list all currently logged-in users on your Ubuntu system using two fundamental commands: who and w.

Method 1: The ‘who’ Command

The who command provides a clean, straightforward list of every user currently authenticated on the system, regardless of whether they are logged in locally (via a physical keyboard and monitor) or remotely (via SSH).

1. Open your Ubuntu terminal.
2. Type the following command:

   who

3. Press Enter.

The output will display several columns of information:

• Username: The account name of the logged-in user.
• Terminal: The terminal line they are using (e.g., tty1 for local, pts/0 for SSH).
• Login Time: The exact date and time the user established their session.
• IP Address: If the user is connected remotely via SSH, their originating IP address will be displayed in parentheses.

Method 2: The ‘w’ Command

If you need more context—specifically, what those users are actually doing right now—the w command is much more powerful. It provides everything the who command does, plus system performance metrics and the current active process for each user.

1. In the terminal, type:

   w

2. Press Enter.

The output is divided into two sections. The header row displays the current system time, how long the server has been running (uptime), the total number of logged-in users, and the system load averages for the past 1, 5, and 15 minutes.

Below the header is a table detailing the users. The most important columns are:

• USER, TTY, FROM, LOGIN@: The same information provided by the who command.
• IDLE: How long it has been since the user pressed a key. This is incredibly useful for determining if an SSH session has been abandoned.
• JCPU & PCPU: CPU time used by all processes attached to the terminal, and the CPU time used by the current process.
• WHAT: The exact command or script the user is currently executing (e.g., nano, top, bash).

By checking the w command, you can instantly see if another administrator is in the middle of editing a critical configuration file before you attempt to modify it yourself.