≡ Menu

4 Ways to Identify Who is Logged-In on Your Linux System

This article is written by Hari Haran.
 
As a system administrator, you may want to know who is on the system at any give point in time. You may also want to know what they are doing. In this article let us review 4 different methods to identify who is on your Linux system.

1. Get the running processes of logged-in user using w

w command is used to show logged-in user names and what they are doing. The information will be read from /var/run/utmp file. The output of the w command contains the following columns:

  • Name of the user
  • User’s machine number or tty number
  • Remote machine address
  • User’s Login time
  • Idle time (not usable time)
  • Time used by all processes attached to the tty (JCPU time)
  • Time used by the current process (PCPU time)
  • Command currently getting executed by the users

 
Following options can be used for the w command:

  • -h Ignore the header information
  • -u Display the load average (uptime output)
  • -s Remove the JCPU, PCPU, and login time.

 

$ w
 23:04:27 up 29 days,  7:51,  3 users,  load average: 0.04, 0.06, 0.02
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
ramesh   pts/0    dev-db-server        22:57    8.00s  0.05s  0.01s sshd: ramesh [priv]
jason    pts/1    dev-db-server        23:01    2:53   0.01s  0.01s -bash
john     pts/2    dev-db-server        23:04    0.00s  0.00s  0.00s w

$ w -h
ramesh   pts/0    dev-db-server        22:57   17:43   2.52s  0.01s sshd: ramesh [priv]
jason    pts/1    dev-db-server        23:01   20:28   0.01s  0.01s -bash
john     pts/2    dev-db-server        23:04    0.00s  0.03s  0.00s w -h

$ w -u
 23:22:06 up 29 days,  8:08,  3 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
ramesh   pts/0    dev-db-server        22:57   17:47   2.52s  2.49s top
jason    pts/1    dev-db-server        23:01   20:32   0.01s  0.01s -bash
john     pts/2    dev-db-server        23:04    0.00s  0.03s  0.00s w -u

$ w -s
 23:22:10 up 29 days,  8:08,  3 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM               IDLE WHAT
ramesh   pts/0    dev-db-server        17:51  sshd: ramesh [priv]
jason    pts/1    dev-db-server        20:36  -bash
john     pts/2    dev-db-server         1.00s w -s

2. Get the user name and process of logged in user using who and users command

who command is used to get the list of the usernames who are currently logged in. Output of the who command contains the following columns: user name, tty number, date and time, machine address.

$ who
ramesh pts/0        2009-03-28 22:57 (dev-db-server)
jason  pts/1        2009-03-28 23:01 (dev-db-server)
john   pts/2        2009-03-28 23:04 (dev-db-server)

 
To get a list of all usernames that are currently logged in, use the following:

$ who | cut -d' ' -f1 | sort | uniq
john
jason
ramesh

 

Users Command

users command is used to print the user name who are all currently logged in the current host. It is one of the command don’t have any option other than help and version. If the user using, ‘n’ number of terminals, the user name will shown in ‘n’ number of time in the output.

$ users
john jason ramesh

3. Get the username you are currently logged in using whoami

whoami command is used to print the loggedin user name.

$ whoami
john

 
whoami command gives the same output as id -un as shown below:

$ id -un
john

 
who am i command will display the logged-in user name and current tty details. The output of this command contains the following columns: logged-in user name, tty name, current time with date and ip-address from where this users initiated the connection.

$ who am i
john     pts/2        2009-03-28 23:04 (dev-db-server)

$ who mom likes
john     pts/2        2009-03-28 23:04 (dev-db-server)

Warning: Don't try "who mom hates" command.

Also, if you do su to some other user, this command will give the information about the logged in user name details.

4. Get the user login history at any time

last command will give login history for a specific username. If we don’t give any argument for this command, it will list login history for all users. By default this information will read from /var/log/wtmp file. The output of this command contains the following columns:

  • User name
  • Tty device number
  • Login date and time
  • Logout time
  • Total working time
$ last jason
jason   pts/0        dev-db-server   Fri Mar 27 22:57   still logged in
jason   pts/0        dev-db-server   Fri Mar 27 22:09 - 22:54  (00:45)
jason   pts/0        dev-db-server   Wed Mar 25 19:58 - 22:26  (02:28)
jason   pts/1        dev-db-server   Mon Mar 16 20:10 - 21:44  (01:33)
jason   pts/0        192.168.201.11  Fri Mar 13 08:35 - 16:46  (08:11)
jason   pts/1        192.168.201.12  Thu Mar 12 09:03 - 09:19  (00:15)
jason   pts/0        dev-db-server   Wed Mar 11 20:11 - 20:50  (00:39

 
This article is written by Hari Haran. He is working in bk Systems (p) Ltd, and interested in contributing to the open source. The Geek Stuff welcomes your tips and guest articles.

If you enjoyed this article, you might also like..

  1. 50 Linux Sysadmin Tutorials
  2. 50 Most Frequently Used Linux Commands (With Examples)
  3. Top 25 Best Linux Performance Monitoring and Debugging Tools
  4. Mommy, I found it! – 15 Practical Linux Find Command Examples
  5. Linux 101 Hacks 2nd Edition eBook Linux 101 Hacks Book

Bash 101 Hacks Book Sed and Awk 101 Hacks Book Nagios Core 3 Book Vim 101 Hacks Book

{ 24 comments… add one }

  • Ronald March 31, 2009, 11:52 am

    I only knew the ‘w’ command, so the rest is new for me!

    I just wanna say i like your blog, and keep posting :)

    Thanks,

  • Ramesh March 31, 2009, 11:54 pm

    @Ronald,

    I’m glad you learned some new tips from this article. I sincerely appreciate your nice comments about this blog.

  • Anonymous April 2, 2009, 12:18 pm

    Thank you for posting this blog.It is very useful for me. Keep on posting

  • Miguimon April 9, 2009, 9:58 am

    I liked the “who mom likes” command, I actually did not know about this one. Cool :)

  • Ramesh April 10, 2009, 3:33 pm

    @Miguimon,

    “who mom likes” and “who mom hates” are exactly the same as “who am i”. As long as there are two arguments next to who, it will work. :)

  • jennifer April 13, 2009, 12:03 am

    I know this blog from your free ebook, ‘Linux 101Hacks’, Cool. I prefer ues who, whoami and w. Never know there are so many other commands. thank you for so detailed explaining.

  • Marko July 8, 2009, 4:35 pm

    Hello!
    Lots of stuff to learn in Linux ( I’ve started 2 years ago) and still don’t know nothing….
    But thanks to guys like Ramesh who are willing to learn us for free I slowley makeing a progress…
    Thanks!

    ps.: my web site is in Slovenian language so visitor probably won’t understand it but if someone is intrested there are photos of my kids (triplets) and so on….

  • Ramesh Natarajan July 8, 2009, 9:57 pm

    @Jennifer, Thanks for the comments. I’m glad that you found this blog and the free eBook helpful.

    @Marko, Thanks for the very kind words. I’m happy that you find this site helpful in your Linux learning process. I did visit your site and saw pictures of your kids. They are very cute. I’m sure they are keeping you super busy. :)

  • Marko July 9, 2009, 2:48 am

    Hi,
    thanks you for taking the time and visit my website, which was first started in year 2000 when my kids were born, just as an experiment and it was running om my desktop pc (winXP and Apache) without registerd domain….just for friends to whom I’ve told the address of the site….
    Later on when I purchased an Asus router and find out that is capable of running all kind of stuff on linux including web server, I decided to register my own domain and started with “PC help” site, to help users of Windows…; later when my kids joind Judo club I was asked if I would be able to make webpage for them so Istarted with Judo page ( now the page which I edit most frequently)
    And here is the best thing out of all this: I started to learn Linux.

    That was a bit of history, I hope my English is understandable, and I hope I was not to boring….

    Bye
    Marko

  • Ramesh Natarajan July 14, 2009, 10:28 pm

    @Marko, Thanks for sharing your personal journey about your website. It is very interesting story. Like you’ve mentioned “Learning Linux” is always the fun part and looks like you did that while having fun and building your website.

  • Yaggi December 3, 2009, 7:27 pm

    Hi,

    What is the command to view all the users in a machine either logged-in or log out.? What I have in mind is to go to home directory and issue an ls command.

    ALso, how to view those hidden accounts?

  • symo February 12, 2010, 6:47 am

    Thanks bro!!! U making us be who we will be soon….Thanks.

  • Anitha March 4, 2010, 1:22 am

    Thanks for this article … ths is very intersting i want to know more about user login…
    pls publish article lik ths about User Log out what happens

    Thanks

  • Syed aown raza May 31, 2010, 5:06 am

    can any body tell me how to find all logged-in users with usernames of at least four characters

  • JOshi MP July 10, 2012, 1:05 am

    Do we have any option to find out the user logged in as a FTP user . Is there any way to find out the user loged in using FTP to the server other than looking into ftp server logs ?

    thanks,
    Joshi

  • Aditya October 10, 2012, 7:14 am

    Hi,

    I have a unix script with the below content, But I am not able to identify it .

    Can anyone help me out.
    jagmsgbp 20411 21312 0 16:38:19 pts/2 0:00 /bin/ksh ./mq_sweep.ksh 2 10 2 5

    Thanks

  • Anthony November 14, 2012, 4:24 pm

    Very useful. Thanks :)

  • PRASHANT September 18, 2013, 12:56 am

    Can you help me in writing a java program that list all the logged in users in my linux system the condition is that I can not use system calls….plz help Me

  • Wakatana October 20, 2013, 1:19 pm

    This wont prit users logged throught X sessions

  • vaibhav singh February 10, 2014, 4:14 am

    concise and informative. keep up!

    When I get [priv] as following. What does it mean?

    ramesh pts/0 dev-db-server 17:51 sshd: ramesh [priv]

    If This is a way to hide user activity? If so how can I unhide 😀

  • Deiveegaraja March 31, 2014, 5:15 am

    Very useful.. Thanks for the article. :-)

  • Akshay April 30, 2014, 3:41 am

    Dear All,

    I want to create an script in which i have to Get the list of all users logged in some machine from 22/04/2014 to 29/03/2014.

    Can soem one please help me out

  • Joe December 19, 2014, 1:51 pm

    Good info, but what if you wanted to know all users running commands?
    None of those options show service accounts.

    I use the following to get a list of all users running commands.
    ps -eo user |sort -u
    I can then loop through each user and get stats like total cpu, & mem consumption, total number of processes spawned by user ect.

    cheers

  • ashokkrishna April 3, 2015, 4:33 pm

    when i run

    ashokkrishna@ashokkrishna-Lenovo-B560:~$ who -l
    LOGIN tty4 2015-04-03 23:08 894 id=4
    LOGIN tty5 2015-04-03 23:08 898 id=5
    LOGIN tty3 2015-04-03 23:08 907 id=3
    LOGIN tty6 2015-04-03 23:08 910 id=6
    LOGIN tty1 2015-04-03 23:08 1491 id=1
    LOGIN tty2 2015-04-04 03:55 9448 id=2

    why the username is LOGIN and i logged in tty7 only but it is showing the users tty1,2,3,4,5

Leave a Comment