Linux / UNIX: See If Particular Users Are Logged Into Server

How do I see if my friends or coworkers are logged into the same Linux or BSD or UNIX (AIX, HP-UX, Apple OS X) server / workstation as I am from a command line?

There are various commands and shell environment variable settings to notify you about your friends login activity under UNIX like operating systems.


Check If Friends or Coworkers Logged In…

Open a command-line terminal (select Applications > Accessories > Terminal), and then type the following commands:
$ who
$ who -H

Sample outputs:

NAME     LINE         TIME             COMMENT
vivek    tty7         2011-04-18 15:14 (:0)
vivek    pts/2        2011-04-18 22:16 (:0.0)
vivek    pts/3        2011-04-18 22:17 (:0.0)
foo      pts/4        2011-04-19 00:36 (localhost)
root     pts/0        2011-04-18 13:53 (

who command display who is on the system i.e. show who is logged on UNIX system. You can filter out output with the UNIX / Linux grep command as follows:
$ who | grep 'Friend-name-here'
See if tom user us logged into your Unix system, enter:
$ who | grep 'tom'
The w command displays who is logged on and what they are doing on Linux / UNIX system. Open a terminal and type the following command:
$ w
Sample outputs:

 14:07:35 up 43 days, 17:44,  1 user,  load average: 0.62, 0.89, 0.90
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
vivek    tty7     :0               15:14    9:25m 24:00   0.39s gnome-session
vivek    pts/2    :0.0             22:16    1:42   0.18s  0.00s ssh foo@localhost
vivek    pts/3    :0.0             22:17    0.00s  0.23s  0.01s w
jasmi    pts/4    localhost        00:36    1:38   0.19s  0.19s vim 
root     pts/0        13:53    0.00s  0.05s  0.00s w

A Note About TCSH watch Variable

The watch variable under TCSH (C shell) stores a list of user/terminal pairs to watch for logins and logouts. The syntax is as follows:

set watch="user1 any user2 any"
set watch="5 user1 any user2 any"

In this example, you are watching tom user from any terminal:

set watch="tom any"

To watch user tom from pts0 terminal only, enter:

set watch="tom pts0"

To watches all users and terminals, enter:

set watch="any any"


set watch = (jerry pts1 any console vivek any)

By default Logins and logouts are checked every 10 minutes, but the first word of watch can be set to a number to check every so many minutes. In this example reports all (any) login and logout once every five minutes:

set watch = (5 any any)

The log command can display reports immediately:


Sample outputs:

root has logged on pts/0 from
vivek has logged on pts/1 from

You can set the format string for watch messages using who variable:

set watch = ( %n )

Sample outputs:


You can use the following format strings:

  • %n – Display username.
  • %a – Display ‘logged on’ or ‘logged off’ message.
  • %l – Display terminal name.
  • %M or %m – Display FQDN (hostname) or local for local logins.

The default who is set to “%n has %a %l from %m.“.

Shell Aliase

Bash or Ksh or any standard UNIX shell aliases allow a string to be substituted for a word when it is used as the first word of a simple command i.e. you can create a shortcut to simple commands. First, create a list of friends that you would like to monitor in ~/.who file:

cat ~/.who

Next, create an aliase called buddies to watch their login / logout activity (add to your ~/.bashrc file), enter:

alias buddies="who | grep -f ~/.who"


alias buddies="w | grep -f ~/.who"

The buddies alias will act as command after you log out and log in again. Alternatively, simply source your ~/.bashrc file, enter:
$ source ~/.bashrc
$ buddies

🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04

1 comment… add one
  • break Apr 19, 2011 @ 9:40

    Hello Vivek,

    just for the record – if user use something like “screen” to run command, “who” or “w” can confuse.

    However “ps aux | grep -i username” should work as expected

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.