When you share a server with a team or investigate unexpected activity, the first question is simple: who is on this machine right now? The who command reads from the system session records and answers exactly that it lists every active user session with their terminal, login time, and where they connected from.
The basic syntax is:
bashwho [OPTION]... [FILE | ARG1 ARG2]
Run without arguments to see all active sessions:
bashwho
root pts/0 2026-04-12 20:10 (10.10.0.2)linuxize pts/1 2026-04-12 20:11 (10.10.0.8)
Each line has four fields: the username, the terminal, the login time, and the hostname or IP the session came from. To force IP addresses instead of resolved hostnames, add --ips.
Use -H to print column headings:
bashwho -H# NAME LINE TIME COMMENT
who reads from /var/run/utmp by default, which tracks active sessions. To check login history instead, pass /var/log/wtmp as an argument:
bashwho /var/log/wtmp | tail -20
The who am i quirk. When you pass any two non-option arguments, who prints only the information about your own current terminal — the same result as -m. This is why who am i, who mom love, and who foo bar all produce the same output. It is a Unix convention, not special parsing of those specific words:
bashwho am iwho -m # same result
| Option | Effect |
|---|---|
-H | Print column headings |
-b | Show the time of the last system boot |
-q | Show usernames only and a total count (# users=N) |
-m | Show only the current terminal session (equivalent to who am i) |
-a | Print all available fields: boot time, runlevel, dead processes, and sessions |
The -b option is useful for establishing a timeline alongside active sessions:
bashwho -b# system boot 2026-04-10 19:02
The -r option shows the current runlevel. On modern systemd-based hosts, the output is often limited or empty — treat it as legacy output rather than a reliable status check.
The -q option gives the fastest summary:
bashwho -q# root linuxize# # users=2
These three commands answer three different questions:
whoami – prints only your own effective username. Use it after sudo or su to confirm the identity you are running as.who – lists every user currently logged in: terminal, login time, and source host.w – shows the same user list plus system load averages, per-session idle time, and the command each user is currently running. Use w when you want to know what active users are doing, not just that they are connected.For historical login records rather than current sessions, reach for last.
Use who for active sessions, who -H to add column headings, who /var/log/wtmp for login history, and w when you also need to see idle time and current activity. Leave a comment below if you run into any issues.
This cheat sheet covers the essential Kali Linux commands every pentester and ethical hacker uses…
When I first started learning malware analysis and reverse engineering, I thought the hardest part…
Both git fetch and git pull talk to a remote repository, but they do very different things to your…
Sometimes the change you need already exists, just on the wrong branch. A hotfix lands…
Email is still one of the most important communication channels inside modern applications. Password resets,…
Nginx is a high-performance web server and reverse proxy trusted by some of the largest…