w

What it does

w displays a summary of currently logged-in users along with what each one is doing. The first line mirrors uptime (current time, system uptime, number of users, load averages), and each subsequent line shows a user's login name, terminal, remote host (if applicable), login time, idle time, and the command currently running in that session.

Beginner examples

• w — show all logged-in users and their current activity
• w shivam — show sessions for just the user shivam
• w -h — show the same output without the header line
• w -s — show a shorter version with fewer columns

w

Advanced examples

• Script-friendly listing of logged-in usernames only: w -h | awk '{print $1}' | sort -u
• Check how idle each session is to spot abandoned logins: review the IDLE column
• Identify where a suspicious session connected from: check the FROM column for a remote IP/hostname
• Combine with ps to inspect a specific user's running process in more detail once w shows what they're running
• Avoid slow output on systems with unreliable DNS/NIS lookups: w -u

w -h | awk '{print $1, $3, $NF}'

Common mistakes

• Confusing the WHAT column (currently running foreground command) with a full process list for that user — for a complete picture, use ps -u <user>.
• Assuming a long IDLE time means the user isn't really logged in — it just means no input has been typed in that session for a while; the session may still be valid.
• Treating w's load-average header line as unique to w — it's the same data uptime reports, just bundled at the top.
• Forgetting w only reflects currently logged-in sessions; for historical login data, last is the right tool instead.

Tips

• Use w -h when piping into awk/grep in scripts, so the header row doesn't need to be filtered out separately.
• Check the FROM column first when investigating unexpected logins — it often shows the originating IP or hostname of a remote SSH session.
• Run w <username> to narrow output to one user's sessions on a busy multi-user server instead of scanning the full list.

Best practices

• During an incident response, cross-reference w's FROM and LOGIN@ columns with last and system auth logs to build a fuller picture of who has (or had) access.
• Don't rely on IDLE time alone to decide whether to kill a session — verify what the session is actually doing (WHAT column, or ps) before terminating it.
• On shared servers, periodically checking w is a lightweight habit for noticing unexpected concurrent logins before they become a problem.

Real-world use cases

• Checking who else is logged into a shared server before performing a risky maintenance operation like a reboot.
• Spotting a suspicious or unfamiliar remote login by reviewing the FROM column.
• Quickly seeing what long-running command a teammate is executing on a shared box.
• Getting an at-a-glance system load summary (same header as uptime) alongside user activity.

Common interview questions

• How does w differ from who? w adds a system load/uptime summary and shows what each logged-in user is currently running (plus CPU time); who only lists logged-in users, terminals, and login times.
• What do the JCPU and PCPU columns represent? JCPU is total CPU time used by all processes attached to that session; PCPU is CPU time used by just the process shown in the WHAT column.
• How would you check if someone is logged in from a suspicious remote address? Run w and inspect the FROM column, which shows the remote hostname/IP for each session.