Identifies the users currently logged in.
who [ -a | -b -d -i -l -m -p -q -r -s -t -u -w -A -H -T ] [ File ]
who am { i | I }
The who command displays information about all users currently on the local system. The following information is displayed: login name, tty, date and time of login. Entering who am i or who am I displays your login name, tty, date and time you logged in. If the user is logged in from a remote machine, then the host name of that machine is displayed as well.
The who command can also display the elapsed time since line activity occurred, the process ID of the command interpreter (shell), logins, logoffs, restarts, and changes to the system clock, as well as other processes generated by the initialization process.
The general output format of the who command is as follows:
Name [State] Line Time [Activity] [Pid] [Exit] (Hostname)
| Name | Identifies the user's login name. |
| State | Indicates whether the line is writable by everyone (see the -T flag). |
| Line | Identifies the line name as found in the /dev directory. |
| Time | Represents the time when the user logged in. |
| Activity | Represents the hours and minutes since activity last occurred on that user's line. A . (dot) here indicates line activity within the last minute. If the line has been quiet more than 24 hours or has not been used since the last system startup, the entry is marked as old. |
| Pid | Identifies the process ID of the user's login shell. |
| Term | Identifies the process termination status (see the -d flag). For more information on the termination values, refer to the wait subroutine or to the /usr/include/sys/signal.h file. |
| Exit | Identifies the exit status of ended processes (see the -d flag). |
| Hostname | Indicates the name of the machine the user is logged in from. |
To obtain information, the who command normally examines the /etc/utmp file. If you specify another file with the File parameter, the who command examines that file instead. This new file is usually the /var/adm/wtmp or /etc/security/failedlogin file.
If the File parameter specifies more than one file name, only the last file name will be used.
Note: This command only identifies users on the local node.
| -a | Processes the /etc/utmp file or the named file with all information. Equivalent to specifying the -bdlprtTu flags. |
| -b | Indicates the most recent system startup time and date. |
| -d | Displays all processes that have expired without being regenerated by init. The exit field appears for dead processes and contains the termination and exit values (as returned by wait) of the dead process. (This flag is useful for determining why a process ended.) |
| -l | Lists any login process. |
| -m | Displays information about the current terminal only. The who -m command is equivalent to the who am i and who am I commands. |
| -p | Lists any active process that is currently active and has been previously generated by init. |
| -q | Prints a quick listing of users and the number of users on the local system. |
| -r | Indicates the current run-level of the process. |
| -s | Lists only the name, line, and time fields. This flag is the default; thus, the who and who -s commands are equivalent. |
| -t | Indicates the last change to the system clock by the root user using the date command. If the date command has not been run since system installation, the who -t command produces no output. |
| -u or -i | Displays the user name, tty, login time, line activity, and process ID of each current user. |
| -A | Displays all accounting entries in the /etc/utmp file. These entries are generated through the acctwtmp command. |
| -H | Displays a header (title). |
| -T or -w | Displays the state of the tty and indicates who can write to that tty as follows: |
This command returns the following exit values:
| 0 | Successful completion. |
| >0 | An error occurred. |
whoInformation similar to the following is displayed:
joe lft/0 Jun 8 08:34
who am iInformation similar to the following is displayed:
george lft/0 Jun 8 08:34
who /var/adm/wtmpInformation similar to the following is displayed:
hank lft/0 Jun 8 08:34 (ausnix5) john lft/0 Jun 8 08:34 (JIKey) mary lft/0 Jun 8 08:22 (machine.austin.ibm) jan pts4 Jun 8 09:19 (puff.wisc.edu)
who -rInformation similar to the following is displayed:
. run-level 2 Jun 8 04:15 2 0 s
who -pInformation similar to the following is displayed:
srcmstr . Jun 8 04:15 old 2896 cron . Jun 8 04:15 old 4809 uprintfd . Jun 8 04:15 old 5158
who -a /var/adm/wtmpInformation similar to the following is displayed:
Name ST Line Time Activity PID Hostname Term Exit console - . Jan 09 14:10 old 2246 id= rc . . Jan 09 14:10 old 2246 id= rc term=0 exit=0 srcmstr - . Jan 09 14:10 old 2007 id=srcmstr IP daemo - . Jan 09 14:10 old 4568 id=rctcpip . . Jan 09 14:10 old 4568 id=rctcpip term=0 exit=0 nick - lft/0 Jan 08 14:57 22:32 3638 . lft/0 Jan 08 14:57 22:32 3638 id= cons term=1 exit=0 console - lft/0 Jan 08 14:57 22:32 15419 id= cons . lft/0 Jan 08 14:57 22:32 15419 id= cons term=9 exit=0 root + pts/1 Jan 09 12:29 . 12995 (portia) . lft/0 Jan 09 13:56 22:32 3339 id= cons term=0 exit=0 console - lft/0 Jan 09 13:56 22:32 3437 id= cons . lft/0 Jan 09 13:56 22:32 3437 id= cons term=2 exit=0
| /etc/utmp | |
| Contains user and accounting information. | |
| /etc/security/failedlogin | |
| Contains the history of all invalid logins. | |
| /var/adm/wtmp | |
| Contains the history of all logins since the file was last created. | |
| /usr/include/sys/signal.h | Contains a list of termination values. |
The date command, mesg command, whoami command su command.
The wait subroutine.