who

What it does

who lists everyone currently logged into the system, showing each session's username, terminal (tty or pts), and login time, with optional columns for the remote host, idle time, and process ID. It reads from the live utmp file (typically /var/run/utmp), which is why it only reflects active sessions — not historical ones.

Beginner examples

• who — list all currently logged-in users and their terminals
• who -b — show the system's last boot time
• who -q — show just usernames plus a total count, in a compact format
• who am i — show details for just the current session (note: no dash, two words)

who

Advanced examples

• Show idle time for every session to spot abandoned logins: who -u
• Combine boot time with current sessions for a quick health check: who -b; who
• Count how many distinct users are logged in: who -q
• Show the current runlevel/target alongside logged-in users: who -ar
• Extract just usernames for scripting: who | awk '{print $1}' | sort -u

who | awk '{print $1}' | sort -u

Common mistakes

• Expecting who to show historical logins — it only reflects sessions that are currently active; use last for history.
• Confusing who (a single command, no space) with who am i (two words) — the latter is a special idiom that shows only the invoking session's own line.
• Assuming who's IDLE column (only shown with -u) is included by default — it isn't; plain who omits idle time unless explicitly requested.
• Treating who's user list as authentication/security proof — it reflects session records, not a live permissions check.

Tips

• Use who -q for a fast headcount of logged-in users on a busy shared server without scanning full session details.
• who am i is handy inside scripts or prompts that need to identify "this exact session" rather than the general current user.
• Combine who with last when investigating access — who for "right now," last for "how did we get here."

Best practices

• Use who -u (idle time) before terminating what looks like an abandoned session, to confirm it's actually inactive rather than just quiet.
• Prefer w over who when you also need to know what each user is currently doing, not just that they're logged in.
• Don't use who's output as a sole authorization check in scripts — it's informational, not an access-control mechanism.

Real-world use cases

• Quickly checking who else is logged into a shared server before performing maintenance.
• Confirming system boot time (who -b) as a lightweight alternative to uptime -s.
• Scripting a headcount of active sessions for capacity or usage monitoring.
• Spotting unexpected or unfamiliar logged-in sessions during a security check.

Common interview questions

• How is who different from w? who lists logged-in users, terminals, and login times; w shows the same information plus a system load summary and what command each user is currently running.
• How would you find out when the system last booted using who? who -b prints the last boot time.
• How is who different from last? who shows only users currently logged in right now; last shows historical login/logout records, including sessions that have already ended.