The Multi-User Environment
Unlike a personal Windows laptop, a Linux server is designed from the ground up to be a true multi-user environment. It is completely normal for a massive corporate web server to have five different system administrators, three database engineers, and two automated backup scripts all actively logged into the machine at the exact same time via remote SSH connections.
If you need to reboot the server to install a critical kernel patch, you cannot just type reboot blindly. If you do, you might instantly sever the connection of a database engineer who is in the middle of running a fragile SQL migration, corrupting the database.
Before you perform any disruptive maintenance on a Linux machine, you must check exactly who is currently logged into the system and what they are doing. You can do this instantly using the who command.
Step 1: The Basic who Command
To see a simple, straightforward list of every human being currently connected to the server, simply run:
who
The terminal will output a clean list with several columns of data. For example:
jsmith pts/0 2026-08-22 09:14 (192.168.1.50)
admin pts/1 2026-08-22 11:30 (10.0.5.12)
- Username: The exact Linux account they used to log in.
- Terminal: The virtual teletype interface (
pts/0) they are connected to. - Login Time: The exact date and time they established the connection.
- IP Address: The physical location (in parentheses) they are connecting from. If they are sitting physically at the keyboard attached to the server, this will be blank or say
(:0).
Step 2: Checking Detailed Idle Times
If you see that “jsmith” is logged in, you still don’t know if he is actively typing commands, or if he went to lunch three hours ago and simply forgot to close his SSH window.
To see how long a user has been completely inactive, add the -u (users) flag.
who -u
This adds a new column to the output: Idle Time.
- If you see a dot (
.), it means the user typed a command within the last 60 seconds. They are actively working; do not reboot the server. - If you see a time like
03:15, it means they have not touched their keyboard in 3 hours and 15 minutes. It is likely safe to terminate their session. - If you see the word
old, they have been idle for over 24 hours.
Step 3: Checking System Boot Time
The who command is also the fastest way to check exactly when the server was last rebooted, which is crucial for verifying if a scheduled maintenance restart actually happened overnight.
You can use the -b (boot) flag:
who -b
The output will clearly state the exact date and time the Linux kernel was last initialized (e.g., system boot 2026-08-15 04:00).
Alternative: The ‘w’ Command
While who provides a great overview of connected users, system administrators frequently use its sister command, simply called w.
If you type w and press Enter, Linux will combine the output of the who command with the uptime command, and it adds one massive benefit: the WHAT column.
The w command explicitly tells you exactly what program or script the user is currently running in their terminal (e.g., nano /etc/nginx/nginx.conf). This removes all the guesswork and allows you to see if they are just reading a file, or in the middle of a critical software compilation.