When you share a server with a team or investigate unexpected activity, the first question is simple: who is on this machine right now? The who command reads from the system session records and answers exactly that it lists every active user session with their terminal, login time, and where they connected from.
The basic syntax is:
bashwho [OPTION]... [FILE | ARG1 ARG2]
Run without arguments to see all active sessions:
bashwho
root pts/0 2026-04-12 20:10 (10.10.0.2)linuxize pts/1 2026-04-12 20:11 (10.10.0.8)
Each line has four fields: the username, the terminal, the login time, and the hostname or IP the session came from. To force IP addresses instead of resolved hostnames, add --ips.
Use -H to print column headings:
bashwho -H# NAME LINE TIME COMMENT
who reads from /var/run/utmp by default, which tracks active sessions. To check login history instead, pass /var/log/wtmp as an argument:
bashwho /var/log/wtmp | tail -20
The who am i quirk. When you pass any two non-option arguments, who prints only the information about your own current terminal — the same result as -m. This is why who am i, who mom love, and who foo bar all produce the same output. It is a Unix convention, not special parsing of those specific words:
bashwho am iwho -m # same result
| Option | Effect |
|---|---|
-H | Print column headings |
-b | Show the time of the last system boot |
-q | Show usernames only and a total count (# users=N) |
-m | Show only the current terminal session (equivalent to who am i) |
-a | Print all available fields: boot time, runlevel, dead processes, and sessions |
The -b option is useful for establishing a timeline alongside active sessions:
bashwho -b# system boot 2026-04-10 19:02
The -r option shows the current runlevel. On modern systemd-based hosts, the output is often limited or empty — treat it as legacy output rather than a reliable status check.
The -q option gives the fastest summary:
bashwho -q# root linuxize# # users=2
These three commands answer three different questions:
whoami – prints only your own effective username. Use it after sudo or su to confirm the identity you are running as.who – lists every user currently logged in: terminal, login time, and source host.w – shows the same user list plus system load averages, per-session idle time, and the command each user is currently running. Use w when you want to know what active users are doing, not just that they are connected.For historical login records rather than current sessions, reach for last.
Use who for active sessions, who -H to add column headings, who /var/log/wtmp for login history, and w when you also need to see idle time and current activity. Leave a comment below if you run into any issues.
Nginx is a high-performance web server and reverse proxy trusted by some of the largest…
ufw (Uncomplicated Firewall) sits on top of iptables (or nftables on newer systems) and replaces…
The file command inspects the actual contents of a file and reports its type — regardless of…
chattr sets and removes special file attributes that operate at the filesystem level, separate from standard…
env prints the current environment, sets or removes variables for a single command, and can start…
nmap (Network Mapper) discovers live hosts, identifies open ports, and detects which service is running…