Linux who Command Tutorial for Beginners (8 Examples)

Sometimes, while working on the command line, you might want to know more about logged in users. There exists a command line utility who which you can use to access this kind of information. In this tutorial, we will discuss the basics of who using some easy to understand examples.

But before we do that, it's worth mentioning that all examples here have been tested on Ubuntu 16.04 LTS.

Linux who command

As already mentioned, the who command shows who all are logged in. Here's its syntax:

who [OPTION]... [ FILE | ARG1 ARG2 ]

And following is what the tool's man page says about it:

Print information about users who are currently logged in.

Following are some Q&A-styled examples that will give you a good idea on how this utility works.

Q1. How who command works?

Basic usage is pretty straightforward - just execute the 'who' command.


For example, on my system, the following output was produced:

How who command works

And on a server machine, following output was produced:

Who command result

So the outputs basically shows user 'himanshu' and 'ubuntu' logged in on tty7 and pts/0 (respectively) on February 16 at 09:07 and 09:35 (respectively). The last column shows IP address related information.

Q2. How to access time of last system boot?

For this, use the -b command line option.

who -b

How to access time of last system boot

This info can be accessed using the -d command line option.

who -d

Q4. How to print system login processes?

For this, use the -l command line option.

who -l

How to print system login processes

Q5. How to print active processes spawned by init?

To display all the init-spawned, active processes, use the -p command line option.

who -p

Q6. How to print number of users logged in?

In case you want to print names of all users logged in as well as the total count, use the -q command line option.

who -q

How to print number of users logged in

Q7. How to print last system clock change?

To print the last system clock change, use the -t command line option.

who -t

To print the current run level value, use the -r command line option.

who -r

How to print run level related information


As you'd agree, the who command is pretty easy to understand and use. It does provide a lot of command line options, but the learning curve isn't steep at all. We've discussed the majority of options here. When you're done practicing these, you can learn more about the tool by heading to its man page.

Himanshu Arora

About Himanshu Arora

Himanshu Arora has been working on Linux since 2007. He carries professional experience in system level programming, networking protocols, and command line. In addition to HowtoForge, Himanshu's work has also been featured in some of world's other leading publications including Computerworld, IBM DeveloperWorks, and Linux Journal.

Share this page:

Suggested articles

1 Comment(s)

Add comment


By: john at: 2018-02-27 10:03:55

Odd question but if someone hacks into your system, what would 'who' display?

For most Desktop Linux users, there really isn't a reason to run this command. I would also think that the information displayed by 'who' is fairly consistent, so... wouldn't running 'who' in the background to compare the normal state vs an abnormal state indicate the presence of an unknown user (a possible hack into the a system that only has ONE real user)?