who Command in Linux: Show All Logged-In Users and Sessions

When you share a server with a team or investigate unexpected activity, the first question is simple: who is on this machine right now? The who command reads from the system session records and answers exactly that it lists every active user session with their terminal, login time, and where they connected from.

How to Use the who Command in Linux

The basic syntax is:

bashwho [OPTION]... [FILE | ARG1 ARG2]

Run without arguments to see all active sessions:

bashwho

root     pts/0        2026-04-12 20:10 (10.10.0.2)linuxize pts/1        2026-04-12 20:11 (10.10.0.8)

Each line has four fields: the username, the terminal, the login time, and the hostname or IP the session came from. To force IP addresses instead of resolved hostnames, add --ips.

Use -H to print column headings:

bashwho -H# NAME     LINE         TIME             COMMENT

who reads from /var/run/utmp by default, which tracks active sessions. To check login history instead, pass /var/log/wtmp as an argument:

bashwho /var/log/wtmp | tail -20

The who am i quirk. When you pass any two non-option arguments, who prints only the information about your own current terminal — the same result as -m. This is why who am i, who mom love, and who foo bar all produce the same output. It is a Unix convention, not special parsing of those specific words:

bashwho am iwho -m      # same result

who Command Options

The -b option is useful for establishing a timeline alongside active sessions:

bashwho -b#          system boot  2026-04-10 19:02

The -r option shows the current runlevel. On modern systemd-based hosts, the output is often limited or empty — treat it as legacy output rather than a reliable status check.

The -q option gives the fastest summary:

bashwho -q# root linuxize# # users=2

who vs whoami vs w

These three commands answer three different questions:

• whoami – prints only your own effective username. Use it after sudo or su to confirm the identity you are running as.
• who – lists every user currently logged in: terminal, login time, and source host.
• w – shows the same user list plus system load averages, per-session idle time, and the command each user is currently running. Use w when you want to know what active users are doing, not just that they are connected.

For historical login records rather than current sessions, reach for last.

Use who for active sessions, who -H to add column headings, who /var/log/wtmp for login history, and w when you also need to see idle time and current activity. Leave a comment below if you run into any issues.