How to Display Active Users with the who Command in Linux

When you are administrating a massive, multi-user Linux mainframe, performance degradation or rogue processes are often tied to specific user accounts consuming unauthorized CPU cycles. Before you execute a lethal termination command against a user’s terminal session, you must mathematically prove exactly who is physically connected to the server, where they originated from, and exactly when they initiated their connection. To extract this pristine audit matrix, you must use the who command.

Executing the Authentication Audit

The who command is a deeply focused forensic engine. It interacts directly with the system’s /var/run/utmp file, which mathematically tracks every active login shell currently engaged with the kernel.

To execute the global audit, open your terminal and type:

who

The exact millisecond you press Enter, the engine outputs a highly structured, columnar matrix detailing every single active session on the server.

Analyzing the Output Matrix

The output provides several critical data vectors:

• Username: The exact human-readable account name (e.g., admin or root) that authenticated the session.
• Terminal Line (tty/pts): The physical or virtual terminal the user is attached to. A tty usually indicates a direct, physical console connection (like a keyboard plugged into the server rack). A pts (pseudo-terminal slave) mathematically proves the user is connected remotely via SSH or a GUI terminal emulator.
• Timestamp: The exact chronological date and time the login sequence was successfully executed.
• Remote Host (IP Address): If the user connected via SSH, the engine outputs the absolute IP address or hostname from which the connection originated, providing a pristine vector for tracking external access.

Isolating Your Own Identity

If you are connected via multiple fragmented SSH windows and need to mathematically confirm the exact virtual terminal ID of your current active screen (perhaps to kill a frozen background process), you can force the engine to interrogate only your specific process stream.

Execute:

who am i

This syntax filters the global matrix and outputs only the precise line data for your exact, current terminal connection.