Updated: 3 November 2026 · Applies to: Linux, GNU coreutils who
The who command shows which users are currently logged in to a Linux system, along with the terminal and, for a remote login, the IP address they connected from. Run it on its own for the default view:
who
root tty1 2026-11-01 09:14 alice pts/0 2026-11-03 08:02 (203.0.113.45) bob pts/1 2026-11-03 08:10 (198.51.100.22)
1. Add column headings
The default output has no header row explaining each column. Add one with -H:
who -H
NAME LINE TIME COMMENT root tty1 2026-11-01 09:14 alice pts/0 2026-11-03 08:02 (203.0.113.45) bob pts/1 2026-11-03 08:10 (198.51.100.22)
2. Print just the names and the total count
Useful for a quick "who's on this box right now" check without the full detail:
who -q
root alice bob # users=3
3. Show only the user and host for the current session
The -m flag limits the output to the session you are actually typing in:
who -m
alice pts/0 2026-11-03 08:02 (203.0.113.45)
4. Add a message status column
-T adds a column showing whether each user currently accepts messages from write (+), has blocked them (-), or cannot receive them at all (?):
who -T
root + tty1 2026-11-01 09:14 alice + pts/0 2026-11-03 08:02 (203.0.113.45)
5. Show when the system last booted
who -b
system boot 2026-11-01 09:10
6. Combine boot time with logged in users
who -bu
7. Show the current runlevel
On a systemd based distribution this reports the equivalent systemd target rather than a traditional SysV runlevel:
who -r
8. Show dead processes
A process entry utmp still holds for a terminal session that has since exited without a proper cleanup:
who -d
9. Show active processes spawned by init
who -p
10. Show everything at once
-a is shorthand for combining -b -d --login -p -r -t -T -u into one command, so you get boot time, dead processes, login processes, runlevel, last clock change, message status and logged in users all in a single report:
who -a
For every option who supports, see its manual page:
man who
