who Command

Purpose

Identifies the users currently logged in.

Syntax

who [ -a |  -b -d -i -l -m -p -q -r -s -t -u  -w -A -H -T -X ] [ File  ]

who am { i | I }

Description

The who command displays information about all users currently on the local system. The following information is displayed: login name, tty, date and time of login. Typing who am i or who am I displays your login name, tty, date and time you logged in. If the user is logged in from a remote machine, then the host name of that machine is displayed as well.

The who command can also display the elapsed time since line activity occurred, the process ID of the command interpreter (shell), logins, logoffs, restarts, and changes to the system clock, as well as other processes generated by the initialization process.

The general output format of the who command is as follows:

Name [State] Line Time [Activity] [Pid] [Exit] (Hostname)

where:

Item Description
Name Identifies the user's login name.
State Indicates whether the line is writable by everyone (see the -T flag).
Line Identifies the line name as found in the /dev directory.
Time Represents the time when the user logged in.
Activity Represents the hours and minutes since activity last occurred on that user's line. A . (dot) here indicates line activity within the last minute. If the line has been quiet more than 24 hours or has not been used since the last system startup, the entry is marked as old.
Pid Identifies the process ID of the user's login shell.
Term Identifies the process termination status (see the -d flag). For more information on the termination values, refer to the wait subroutine or to the /usr/include/sys/signal.h file.
Exit Identifies the exit status of ended processes (see the -d flag).
Hostname Indicates the name of the machine the user is logged in from.

To obtain information, the who command usually examines the /etc/utmp file. If you specify another file with the File parameter, the who command examines that file instead. This new file is usually the /var/adm/wtmp or /etc/security/failedlogin file.

If the File parameter specifies more than one file name, only the last file name will be used.

Note: This command only identifies users on the local node.

Flags

Item Description
-a Processes the /etc/utmp file or the named file with all information. Equivalent to specifying the -bdlprtTu flags.
-b Indicates the most recent system startup time and date.
-d Displays all processes that have expired without being regenerated by init. The exit field appears for dead processes and contains the termination and exit values (as returned by wait) of the dead process. (This flag is useful for determining why a process ended by looking at the error number returned by the application.)
-l Lists any login process.
-m Displays information about the current terminal only. The who -m command is equivalent to the who am i and who am I commands.
-p Lists any active process that is currently active and has been previously generated by init.
-q Prints a quick listing of users and the number of users on the local system.
-r Indicates the current run-level of the process.
-s Lists only the name, line, and time fields. This flag is the default; thus, the who and who -s commands are equivalent.
-t Indicates the last change to the system clock by the root user using the date command. If the date command has not been run since system installation, the who -t command produces no output.
-u or -i Displays the user name, tty, login time, line activity, and process ID of each current user.
-A Displays all accounting entries in the /etc/utmp file. These entries are generated through the acctwtmp command.
-H Displays a header (title).
-T or -w Displays the state of the tty and indicates who can write to that tty as follows:
+
Writable by anyone.
-
Writable only by the root user or its owner.
?
Bad line encountered.
-X Prints all available characters of each user name instead of truncating to the first 8 characters. The user name is also moved to the last column of the output.

Exit Status

This command returns the following exit values:

Item Description
0 Successful completion.
>0 An error occurred.

Examples

  1. 1. To display information about who is using the local system node, type: 
    who
    Information similar to the following is displayed: 
    pts/1      Nov  9 00:20   long_username_greater_than_eight_characters  (localhost)
  2. To display your user name, type: 
    who am i
    Information similar to the following is displayed: 
    george lft/0 Jun 8 08:34
  3. To display a history of logins, logouts, system startups, and system shutdowns, type: 
    who /var/adm/wtmp
    Information similar to the following is displayed: 
    hank   lft/0   Jun   8   08:34  (ausnix5)
john   lft/0   Jun   8   08:34  (JIKey)
mary   lft/0   Jun   8   08:22  (machine.austin.ibm)
jan    pts4    Jun   8   09:19  (puff.wisc.edu)
  4. To display the run-level of the local system node, type:

    who  -r

    Information similar to the following is displayed: 
    . run-level 2 Jun 8 04:15 2 0 s
  5. To display any active process that is currently actively and has been previously generated by init, type:

    who  -p

    Information similar to the following is displayed: 
    srcmstr   .    Jun 8  04:15  old  2896
cron      .    Jun 8  04:15  old  4809
uprintfd  .    Jun 8  04:15  old  5158
  6. To process the /var/adm/wtmp file with the -bdlprtTu flags specified, type:

    who  -a /var/adm/wtmp

    Information similar to the following is displayed: 
       .        system boot Jun 19 10:13        
   .        run-level 2 Jun 19 10:13        
   .            .       Jun 19 10:14    old 
   .            .       Jun 19 10:14    old 
   .            .       Jun 19 10:14    old 
rc        -     .       Jun 19 10:13    old 
   .            .       Jun 19 10:16    old 
   .            .       Jun 19 10:14    old 
srcmstr   -     .       Jun 19 10:14    old 
rctcpip   -     .       Jun 19 10:14    old 
rcdce     -     .       Jun 19 10:14    old 
rccm      -     .       Jun 19 10:15    old 
dceupdt   -     .       Jun 19 10:15    old 
rcnfs     -     .       Jun 19 10:15    old 
cron      -     .       Jun 19 10:16    old 
piobe     -     .       Jun 19 10:16    old 
qdaemon   -     .       Jun 19 10:16    old 
writesrv  -     .       Jun 19 10:16    old 
uprintfd  -     .       Jun 19 10:16    old 
   .            .       Jun 19 10:16    old 
LOGIN     - lft0        Jun 19 10:16    old 
   .            .       Jun 19 10:16    old 
   .            .       Jun 19 10:16    old

Files

Item Description
/etc/utmp Contains user and accounting information.
/etc/security/failedlogin Contains the history of all invalid logins.
/var/adm/wtmp Contains the history of all logins since the file was last created.
/usr/include/sys/signal.h Contains a list of termination values.