Previous Table of Contents Next

Module 159


The external who command displays who is logged on the system. With no options, who lists information about each user that is currently logged on to the system. The who command reads the accounting file (/etc/utmp) and returns requested information. The default is the user name, terminal line, and login time. The following table defines all information displayed based on the header that who uses to describe each column of its output.

NAME The user name (LOGNAME).
STATE The write permission of the line (or hardware problem).
+ The line may be written to by other users.
- The line may only be written to by root.
? A problem has been detected with the line.
LINE The terminal tty name (ttyXX).
TIME The time you logged in to the system.
IDLE How long since you've typed something on your terminal.
. It's been less than a minute.
HH:MM It's been HH hours and MM minutes.
old It's been over 24 hours or a boot occurred and no one has logged in on the line.
PID The process ID of your login process (login shell).
COMMENT Any comments related to your line's /etc/inittab entry. This information is placed in the inittab by the system administrator. Common information is the location of the terminal, the associated telephone number, type of terminal, or any other pertinent information.
EXIT The system termination and the program exit values.

BSD (Berkeley)
Some vendors include a command named w which is an enhanced who command. Its output is a combination of the finger and who commands output.


Following is the general format of the who command.

    who [ -HTabdlpqrstu ] [ who_file ]
    who [ -qn x ] [ who_file ]
    who am i
    who am i

BSD (Berkeley)
who [ am i ] [ who-file ]


The following list describes the options and their arguments that may be used to control how who functions.

-H Causes columns headers to be printed. The possible headers are:
-T Same as the default option -s, except the STATE field is displayed. The STATE field informs you of a terminal's tty write permissions. If a + is displayed in the field, anyone can write to the terminal. If a - is displayed, only root can write to the terminal. Root can write to any terminal regardless of permissions. If a ? is displayed, a problem exists with the tty line. Usually caused by a terminal or line sending noise to the computer or a bad asynchornous I/O board.
-a Causes who to function as though all other options where specified. It is equivalent to -bdlpqrstuTH.
-b The date and time of the last system boot is displayed.
-d The processes that have died and not been restarted by init are displayed. The EXIT field contains the termination and exit values of the dead process. Often used to determine why a process terminated.
-l The tty lines that have a getty waiting for a login are displayed. The NAME field contains a LOGIN entry. No STATE of the line is known.
-p Lists any processes started by init that are still active. The NAME field is the name of the program started by init. init refers to the /etc/inittab file to know which programs to start. The STATE, LINE, and IDLE fields are not defined for this option. The COMMENT field contains the contents of the ID field of the /etc/inittab entry for the program.
-q A quick who. Only the names of users currently logged on are displayed in a single line, followed by a line containing the total number of users. This option overrides and cancels all other options.
-n x Specifies the number of users to display per line. x must be at least 1. This option must be used in conjunction with the -q option.
-r Displays the default fields of NAME, LINE, and TIME. Displays the current run level of the system (i.e. the init process). The termination status, process ID, and the exit status of a process are displayed in the IDLE, PID, and COMMENT fields. @T1 = -s.
-t Displays the last time the system clock was changed by root using the date command.
-u Displays the IDLE field in addition to the default NAME, LINE, and TIME fields. The IDLE field contains the time since any activity has occurred on a tty line.

BSD (Berkeley)
Most who commands on BSD systems do not support any options. However, you may find that some BSD systems incorporate some of the System V options. You can usually type who -z to get a usage listing displayed to your terminal.


Only two arguments may be passed to the who command.

am i Your user name, terminal tty, and login time are displayed. Some systems display the hostname before your username. Most BSD systems only require that two arguments be present for this function to be invoked. For example, who are are is equivalent to who am i. Your real user ID and group ID are displayed, even if you have su'd to another login account.
file The binary accounting file containing the necessary information that who displays. The default file is /etc/utmp. An alternate file is /etc/wtmp. Any file may be used but it must be in the utmp format described in section 4 of the UNIX Reference Manual.

BSD (Berkeley)
file The binary accounting file containing the necessary information that who displays. The default file is /etc/utmp. An alternate file is /usr/adm/wtmp. This file contains records of all logins since the file was created. If you run who with this file as an argument, logins, logouts, and system crashes are listed.


Refer to the date, login, mesg, and su commands described in modules 30, 77, 88, and 127, respectively.


The following list of files are related to the who command.

/var/adm/utmp Contains binary accounting information, for users currrently logged on to the system.
/var/adm/wtmp Contains binary accounting information, for last login for each tty. A history of the last logins.
/etc/inittab The system initialize control table.
/etc/utmp The BSD version of the System V /var/adm/utmp file.
/usr/adm/wtmp The BSD version of the System V /var/adm/wtmp file.


The who command has multiple purposes. The most common is to find out who is currently logged in to the system. You may want to know if someone is currently working on the system. The -u option displays how long since they have pressed a key on their keyboard. It can be used to find out when the system was booted. How many tty lines are configured for the system can be displayed by the -l option. The number of users currently logged on to the system can be displayed by using the -q option.

who can be used in shell scripts to find information about a user or terminal. Then decisions can be based on this information. It is a handy and versatile tool that you will find necessary as you use the UNIX System.


In this activity you use the who command to display the users currently logged on and their IDLE time. Then you run a quick who to see how many users are logged on the system. The BSD version does not support day options. Begin at the shell prompt.

1.  Type who -u and press Return. Notice your screen resembles the following display.
    cj> who -u
    NAME         LINE          TIME          IDLE    PID
    bill         tty05      Jan 21 10:21     old     1707
    nancy        tty07      Jan 24 08:17      .      1132
    mylogin      tty11      Jan 25 08:02      .      28138
    tlp          tty17      Jan 25 07:03      5      26324
    jill         tty21      Jan 25 09:39      16     29831
2.  Type who -q and press Return to display how many users are currently logged on to the system.
    cj> who -q
    bill nancy mylogin tlp jill
    # 5
3.  Turn to Module 56 to continue the learning sequence.

Previous Table of Contents Next