UNIX / Linux List Current Logged In Users

How do I print the user names of users currently logged in to the current UNIX / Linux host / server from a command prompt?

You need to use any one of the following command line tools to list currently logged in users on Linux or Unix-like systems.
Tutorial details
Difficulty Easy (rss)
Root privileges Yes
Requirements w or who command on Linux and Unix
Time 5m
The following two file keep login records on Linux and Unix-like systems:
  • /var/run/utmp – Keeps and allows us to discover information about who is currently using the system. Please note that there may be more Linux and Unix users currently using the system, because not all programs use utmp logging. In other words, poorly written app, hidden programs, malware, and other bad stuff will not be useful to list logged in users.
  • /var/log/wtmp – Keeps records all logins and logouts.

We simply cannot read these files using cat command/grep command/egrep command as file is in binary database format. Hence, we use the following commands to find currently logged in users in Linux and Unix-like systems.

Linux Command To List Current Logged In Users

  1. w command – Shows information about the users currently on the machine, and their processes.
  2. who command – Display information about users who are currently logged in.
  3. users command – See the login names of the users currently on the system, in sorted order, space separated, on a single line. It reads all information from /var/run/utmp file.

How to find currently logged in users in Linux

Open a terminal (or login into remote server using ssh command) and type the following commands.

Using w command to list current logged in users under Unix or Linux

Open the terminal application and then type the w command:
$ w

Fig.01: w command in action.

Understanding w command outputs

From Fig.01 we see the following for each user:

  • USER – Linux or Unix login name.
  • TTY – The tty name.
  • FROM The remote host or IP address.
  • @Login – Login time.
  • IDEL – Idle time.
  • JCPU – The JCPU time is the time used by all processes attached to the tty. However, it does not include past background jobs, but does include currently running background jobs.
  • PCPU – The PCPU time is the time used by the current process, named in the “what” field.
  • WHAT – The command line of that users current process.

To see info about a user named tom, enter:
$ w tom
Tell w command not print header:
$ w -h
$ w --no-header

We can also ignore current process username by passing the -u or --no-current to the w command:
$ w -u
$ w --no-current

Want to see remote hostname field? Try:
$ w -f
Show IP address instead of hostname for from field:
$ w -i
We can also old style output. In other words old outputs prints blank space for idle times less than one minute:
$ w -o

Display all logged in users using who command

The who command works on all Unix like operating systems such as macOS, *BSD, Linux and so on. The syntax is pretty simple:
# who
Here is what we see:

root     pts/0        2013-03-12 15:10 (10.1.3.177)

The who command displays the following information:

  • root – The username
  • pts/0 – Type of the terminal device. In this example, we see pseudoterminal pts/0 used by root user.
  • 2013-03-12 15:10 – User login date and time stamp.
  • (10.1.3.177) – The remote IP address from which the user logged into this server.

We can pass the -a option to who command as follows to see time of last system boot, display dead processes, system login processes, active processes spawned by init/systemd, print current runlevel, print last system clock change, show user’s message status, and list users logged in to Linux or Unix box:
# who -a
Here is output from older Linux system (pre Systemd):

           system boot  2013-03-02 04:10
           run-level 3  2013-03-02 04:10
LOGIN      /dev/ttyS1   2013-03-02 04:11              7951 id=v/tt
LOGIN      tty2         2013-03-02 04:11              7953 id=2
LOGIN      tty1         2013-03-02 04:11              7950 id=1
LOGIN      tty3         2013-03-02 04:11              7955 id=3
LOGIN      tty4         2013-03-02 04:11              7957 id=4
LOGIN      tty5         2013-03-02 04:11              7959 id=5
LOGIN      tty6         2013-03-02 04:11              7961 id=6
root     + pts/0        2013-03-12 15:10   .          7451 (10.1.3.177)
           pts/1        2013-03-08 12:29             23510 id=ts/1  term=0 exit=0

Sample outputs from Systemd based Linux sysetem:

Getting help with the whois command

You can pass the following options to the who command (taken from the who command man page):

Just open a  -a, --all         same as -b -d --login -p -r -t -T -u
  -b, --boot        time of last system boot
  -d, --dead        print dead processes
  -H, --heading     print line of column headings
  -l, --login       print system login processes
      --lookup      attempt to canonicalize hostnames via DNS
  -m                only hostname and user associated with stdin
  -p, --process     print active processes spawned by init
  -q, --count       all login names and number of users logged on
  -r, --runlevel    print current runlevel
  -s, --short       print only name, line, and time (default)
  -t, --time        print last system clock change
  -T, -w, --mesg    add user's message status as +, - or ?
  -u, --users       list users logged in
      --message     same as -T
      --writable    same as -T
      --help     display this help and exit
      --version  output version information and exit

users command

Open a terminal or login over the ssh session and enter the following users command:
$ users
Output who is currently logged:

abhi charvi vivek vivek zcafe

Vieing logged in users with last command

Want to see a listing of last logged in users? Use the last command to lookup binary database called /var/log/wtmp and displays a list of all users logged in (and out) since that file was created. For instance see history for user named ‘vivek’:
$ last vivek

vivek    :1           :1               Sat Jan 16 10:19   still logged in
vivek    :1           :1               Tue Jan 12 10:26 - 01:52 (3+15:26)
vivek    :1           :1               Mon Jan 11 12:52 - 03:54  (15:01)
vivek    :1           :1               Sun Jan 10 14:07 - down   (13:20)
vivek    :1           :1               Sat Jan  9 09:10 - 02:50  (17:40)
vivek    :1           :1               Sat Jan  9 09:00 - down   (00:08)
vivek    :1           :1               Thu Jan  7 17:35 - down  (1+09:09)
vivek    :1           :1               Mon Jan  4 10:38 - down  (3+06:44)
vivek    :1           :1               Sun Jan  3 12:16 - 02:41  (14:24)
vivek    :1           :1               Sat Jan  2 20:00 - 02:08  (06:08)
vivek    :1           :1               Sat Jan  2 09:11 - down   (10:47)
vivek    :1           :1               Fri Jan  1 09:58 - 01:30  (15:31)
vivek    :1           :1               Fri Jan  1 02:32 - 04:17  (01:44)
vivek    :1           :1               Thu Dec 31 13:14 - 23:10  (09:55)
vivek    :1           :1               Thu Dec 31 00:12 - 02:37  (02:25)
vivek    :1           :1               Wed Dec 30 12:40 - 22:35  (09:54)
vivek    :1           :1               Wed Dec 30 00:05 - 03:13  (03:08)
vivek    :1           :1               Tue Dec 29 14:10 - 21:27  (07:17)
vivek    :1           :1               Mon Dec 28 09:02 - 00:38  (15:35)
vivek    pts/2        192.168.2.17     Fri Dec 25 23:46 - 15:02  (15:15)
vivek    :1           :1               Thu Dec 24 02:00 - 01:51 (3+23:50)
vivek    :1           :1               Wed Dec 23 12:57 - down   (09:46)
vivek    :1           :1               Tue Dec 22 13:23 - down   (12:19)
...
....
vivek    :1           :1               Tue Dec  8 01:53 - down   (01:15)
vivek    pts/4        192.168.2.25     Wed Dec  2 22:14 - 22:18  (00:03)
......
....
.......
vivek    :0           :0               Fri Oct  4 18:56 - 19:00  (00:04)
vivek    pts/0        192.168.2.25     Fri Oct  4 18:17 - 18:48  (00:31)
vivek    pts/0        192.168.2.25     Fri Oct  4 18:12 - 18:16  (00:03)
vivek    tty1                          Fri Oct  4 18:12 - down   (00:04)
 
wtmp begins Fri Oct  4 18:11:35 2019

See “Linux Find Out Last System Reboot Time and Date Command” for more examples.

Summing up

We learned various commands that see login records stored in utmp and wtmp files. I strongly suggest that you look into the following man pages:
man w
man who
man users
man last
man utmp

See how to keep a detailed audit trail of what’s being done on your Linux systems using the ac command.


🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 14 comments so far... add one

CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
14 comments… add one
  • confy Mar 19, 2008 @ 22:33

    but why not using “w”??

    confy@live:~$ w
    00:35:35 up 13 days, 1:35, 2 users, load average: 0.27, 0.34, 0.58
    USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
    confy tty7 :0 06Mar08 0.00s 3:06 1.59s x-session-manager
    confy pts/0 :0.0 00:33 0.00s 0.09s 0.00s w
    confy@live:~$

    • هادی Jan 24, 2012 @ 22:07

      tnx a lot

  • 4F2E4A2E Oct 14, 2009 @ 5:42

    the awesome w :)

  • Ant May 27, 2011 @ 1:28

    I have a .txt file with denied users listed on it. Is there any way I can run a loop to regularly compare the ‘who’ or ‘users’ output with the list to see if denied users are logging on? I do not want to block the users completely. I am new to unix, any help would be much appreciated.

  • dikshitha Nov 18, 2011 @ 5:31

    we are using linux through putty.
    I want to get an alert when user logged in.how can we write code for that?

    • totosus Mar 22, 2012 @ 12:33

      write a bash script which stores a list of users from the previous output of users and runs it, say, once every ten seconds, and says “user user logged in/out” if something has changed. then run it with

      script.sh &

      . After that it will run in the background, but all output will go to your console, so you could work and see what it says. If you feel that you need to do so, you may add this line in the end of your

      ~/.profile

      file, so that it starts every time you log in.

  • madami Feb 12, 2013 @ 6:22

    w – the better option here

  • Sushil R Aug 24, 2013 @ 20:27

    Hi Sir,

    I have a linux server, for which i have given ssh access to remote users.so now i want some kind of shell script who keep an eye on this ssh users and email me whenever they ssh into my machine.

    sir it possible ? please reply

  • sulut Oct 17, 2013 @ 2:10

    Nice thread. it help sys.admin to show users inactive on a server

  • Wakatana Oct 20, 2013 @ 19:34

    This does not print users logged throught X sessions

  • kishore Apr 7, 2014 @ 11:06

    Unforunately I killed root user with

    pkill -STOP -u root on remote server, now I am unable to connect the remote server, what should I do now, please help me.

    Thanks,
    Kishore.

    • bob May 20, 2015 @ 15:01

      Plug your keyboard (a screen can be useful too) on the server and use “pReborn -potion -u root”

  • chandrasekara n Jun 20, 2016 @ 4:26

    hi sir,
    where can i find the number of users loggd in proc folder?

  • Kavya Dec 6, 2017 @ 10:00

    Hi,

    I am using ‘su’ to login as super user to run batch jobs, but if I have to get my user id (say ‘abc’) though logged in as super user. Any way to get this details?

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Problem posting comment? Email me @ webmaster@cyberciti.biz