[ Previous | Next | Contents | Glossary | Home | Search ]
AIX Version 4.3 Commands Reference, Volume 6

who Command


Identifies the users currently logged in.


who [ -a | -b -d -i -l -m -p -q -r -s -t -u -w -A -H -T ] [ File ]

who am }


The who command displays information about all users currently on the local system. The following information is displayed: login name, tty, date and time of login. Entering who am i or who am I displays your login name, tty, date and time you logged in. If the user is logged in from a remote machine, then the host name of that machine is displayed as well.

The who command can also display the elapsed time since line activity occurred, the process ID of the command interpreter (shell), logins, logoffs, restarts, and changes to the system clock, as well as other processes generated by the initialization process.

The general output format of the who command is as follows:

Name [State] Line Time [Activity] [Pid] [Exit] (Hostname)


Name Identifies the user's login name.
State Indicates whether the line is writable by everyone (see the -T flag).
Line Identifies the line name as found in the /dev directory.
Time Represents the time when the user logged in.
Activity Represents the hours and minutes since activity last occurred on that user's line. A . (dot) here indicates line activity within the last minute. If the line has been quiet more than 24 hours or has not been used since the last system startup, the entry is marked as old.
Pid Identifies the process ID of the user's login shell.
Term Identifies the process termination status (see the -d flag). For more information on the termination values, refer to the wait subroutine or to the /usr/include/sys/signal.h file.
Exit Identifies the exit status of ended processes (see the -d flag).
Hostname Indicates the name of the machine the user is logged in from.

To obtain information, the who command normally examines the /etc/utmp file. If you specify another file with the File parameter, the who command examines that file instead. This new file is usually the /var/adm/wtmp or /etc/security/failedlogin file.

If the File parameter specifies more than one file name, only the last file name will be used.

Note: This command only identifies users on the local node.


-a Processes the /etc/utmp file or the named file with all information. Equivalent to specifying the -bdlprtTu flags.
-b Indicates the most recent system startup time and date.
-d Displays all processes that have expired without being regenerated by init. The exit field appears for dead processes and contains the termination and exit values (as returned by wait) of the dead process. (This flag is useful for determining why a process ended.)
-l Lists any login process.
-m Displays information about the current terminal only. The who -m command is equivalent to the who am i and who am I commands.
-p Lists any active process that is currently active and has been previously generated by init.
-q Prints a quick listing of users and the number of users on the local system.
-r Indicates the current run-level of the process.
-s Lists only the name, line, and time fields. This flag is the default; thus, the who and who -s commands are equivalent.
-t Indicates the last change to the system clock by the root user using the date command. If the date command has not been run since system installation, the who -t command produces no output.
-u or -i Displays the user name, tty, login time, line activity, and process ID of each current user.
-A Displays all accounting entries in the /etc/utmp file. These entries are generated through the acctwtmp command.
-H Displays a header (title).
-T or -w Displays the state of the tty and indicates who can write to that tty as follows:
Writable by anyone.
Writable only by the root user or its owner.
Bad line encountered.

Exit Status

This command returns the following exit values:

0 Successful completion.
>0 An error occurred.


  1. To display information about who is using the local system node, enter:
    Information similar to the following is displayed:
    joe lft/0 Jun 8 08:34
  2. To display your user name, enter:
    who am i
    Information similar to the following is displayed:
    george lft/0 Jun 8 08:34
  3. To display a history of logins, logouts, system startups, and system shutdowns, enter:
    who /var/adm/wtmp
    Information similar to the following is displayed:
    hank   lft/0   Jun   8   08:34  (ausnix5)
    john   lft/0   Jun   8   08:34  (JIKey)
    mary   lft/0   Jun   8   08:22  (machine.austin.ibm)
    jan    pts4    Jun   8   09:19  (puff.wisc.edu)
  4. To display the run-level of the local system node, enter:
    who -r
    Information similar to the following is displayed:
    . run-level 2 Jun 8 04:15 2 0 s
  5. To display any active process that is currently actively and has been previously generated by init, enter:
    who -p
    Information similar to the following is displayed:
    srcmstr   .    Jun 8  04:15  old  2896
    cron      .    Jun 8  04:15  old  4809
    uprintfd  .    Jun 8  04:15  old  5158
  6. To process the /var/adm/wtmp file with the -bdlprtTu flags specified, enter:
    who -a /var/adm/wtmp
    Information similar to the following is displayed:
    Name     ST  Line           Time    Activity    PID  Hostname    Term  Exit
    console   -      .      Jan 09 14:10  old       2246 id=     rc
       .             .      Jan 09 14:10  old       2246 id=     rc term=0 exit=0
    srcmstr   -      .      Jan 09 14:10  old       2007 id=srcmstr
    IP daemo  -      .      Jan 09 14:10  old       4568 id=rctcpip
       .             .      Jan 09 14:10  old       4568 id=rctcpip term=0 exit=0
    nick      - lft/0       Jan 08 14:57 22:32      3638
       .        lft/0       Jan 08 14:57 22:32      3638 id=   cons term=1 exit=0
    console   - lft/0       Jan 08 14:57 22:32     15419 id=   cons
       .        lft/0       Jan 08 14:57 22:32     15419 id=   cons term=9 exit=0
    root      + pts/1       Jan 09 12:29   .       12995 (portia)
       .        lft/0       Jan 09 13:56 22:32      3339 id=   cons term=0 exit=0
    console   - lft/0       Jan 09 13:56 22:32      3437 id=   cons
       .        lft/0       Jan 09 13:56 22:32      3437 id=   cons term=2 exit=0


                          Contains user and accounting information.
                          Contains the history of all invalid logins.
                          Contains the history of all logins since the file was last created.
/usr/include/sys/signal.h Contains a list of termination values.

Related Information

The date command, mesg command, whoami command su command.

The wait subroutine.

[ Previous | Next | Contents | Glossary | Home | Search ]