If you are managing a multi-user Linux server, or if you simply want to check if anyone else is remotely connected to your machine via SSH, you do not need to install complex monitoring software. The Linux terminal includes a remarkably simple built-in command designed specifically to display who is currently logged into the system and exactly what they are doing.
How to Use the w Command
To see the active users on your system, open your terminal and type the single letter:
w
Press Enter. The command will immediately output a formatted table of information.
Understanding the Output
The output of the w command is divided into two parts: a system header and a user table.
The Header: The very first line of the output is identical to the uptime command. It shows the current system time, how long the server has been running without a reboot, the total number of users currently logged in, and the system load averages for the past 1, 5, and 15 minutes.
The User Table: Below the header, you will see a list of every active session with the following columns:
- USER: The username of the logged-in individual.
- TTY: The name of the terminal they are using (e.g.,
pts/0for a remote SSH connection, ortty1for a direct console login). - FROM: The remote IP address or hostname the user connected from.
- LOGIN@: The exact time they logged into the system.
- IDLE: How long it has been since they last typed a command or interacted with the terminal.
- JCPU & PCPU: The amount of CPU time used by all processes attached to their terminal, and the CPU time used by their currently active process.
- WHAT: The exact command or script they are currently running.
If you only want to see the user list and do not care about the header information, you can run the command with the “short” flag: w -s.