who(C)

who -- list who is on the system

Syntax

who [ -aAbdfHlmpqrstTux ] [ -n count ] [ file ]

who am i

who am I

Description

The who command can list the user's name, terminal line, login time, and the elapsed time since activity occurred on the line; it also lists the process ID of the command interpreter (shell) for each current user. It examines the /etc/inittab file to obtain information for the Comments column, and /etc/utmp to obtain all other information. If file is given, that file is examined. Usually, file will be /etc/wtmp, which contains a history of all the logins since the file was last created.

who with the am i or am I option identifies the invoking user.

Except for the default -s option, the general format for output entries is:

name [state] line time activity pid [comment] [exit]

With options, who can list logins, logoffs, reboots, and changes to the system clock, as well as other processes spawned by the init process. These options are:

-a: Process the /etc/utmp file or the named file with all options turned on.
-A: Display UNIX accounting information.
-b: Indicate the time and date of the last reboot.
-d: Display all processes that have expired and have not been respawned by init. The ``exit'' field appears for dead processes and contains the termination and exit values (as returned by wait(C)), of the dead process. This can be useful in determining why a process terminated.
-f: Suppress pseudo-ttys from who output, except for remote logins.
-H: Display column headings above the regular output.
-l: List only those lines on which the system is waiting for someone to login. The ``name'' field is LOGIN in such cases. Other fields are the same as for user entries except that the ``state'' field does not exist.
-m: Equivalent to who am i.
-n count: count specifies the number of columns for the -q option to use when displaying user names.
-p: List any other process which is currently active and has been previously spawned by init. The ``name'' field is the name of the program executed by init as found in /etc/inittab. The ``state'', ``line'', and ``idle'' fields have no meaning. The ``comment'' field shows the ``id'' field of the line from /etc/inittab that spawned this process. See inittab(F).
-q: Quick who; display only the names and the number of users currently logged on. When this option is used, all other options are ignored.
-r: Indicate the current run level of the init process, the date and time at which this run level was entered, the current run level (again), the number of times that the system has been at this run level since last being rebooted, and the previous run level.
-s: List only the ``name'', ``line'', and ``time'' fields. This is the default behavior of who.
-t: Indicate the last change to the system clock (via the date(C) command) by the root user. See su(C).
-T: Equivalent to the -u option, except that the ``state'' of the terminal line is printed. The ``state'' describes whether someone else can write to that terminal. A plus character (+) appears if the terminal is writable by anyone; a minus character (-) appears if it is not. root can write to all lines having a plus character or a minus character in the ``state'' field. If a bad line is encountered, a question mark (?) is displayed.
-u: List only those users who are currently logged in. The ``name'' is the user's login name. The ``line'' is the name of the line as found in the directory /dev. The ``time'' is the time that the user logged in. The ``activity'' is the number of hours and minutes since activity last occurred on that particular line. A dot (.) indicates that the terminal has seen activity in the last minute and is therefore ``current.'' If more than twenty-four hours have elapsed or the line has not been used since boot time, the entry is marked ``old''.
This field is useful when trying to determine whether a person is working at the terminal or not. The ``pid'' is the process ID of the user's shell. The ``comment'' is the comment field. It can contain information about where the terminal is located, the telephone number of the dataset, the type of terminal if hard-wired, and so on.
-x: Print the hostname. If file is not used to specify the pathname of a utmpx(F) format file, who reads /etc/utmpx.

Exit values

who returns 0 on successful completion. A value of 1 indicates that an error occurred; values greater than 1 correspond to system errors documented in .Intro(S-osr5)

Examples

Indicate when the system was last rebooted:

who -b

List those users currently logged in, and print a heading above the list:

who -uH

Files

/etc/utmp: login database
/etc/utmpx: extended version of /etc/utmp
/etc/wtmp: login database
/etc/wtmpx: extended version of /etc/wtmp
/etc/inittab: script read by the init process

Standards conformance

who is conformant with:

ISO/IEC DIS 99452:1992, Information technology Portable Operating System Interface (POSIX) Part 2: Shell and Utilities (IEEE Std 1003.21992);
AT&T SVID Issue 2;
X/Open CAE Specification, Commands and Utilities, Issue 4, 1992.