whoList logged-in users
who lists the login sessions currently open on the machine: user, terminal, login time and where they connected from. It also tells you when the system last booted. Check it before a reboot and after a suspicious alert.
who [OPTION]... [FILE | am i]You need to reboot devops-lab for a kernel patch and want to know who you'd kick off.
whoReads the utmp login records (coreutils).
Login programs (sshd, login, terminal emulators, tmux) write a record to /var/run/utmp when a session starts and mark it dead when it ends; the same records are appended to /var/log/wtmp as history. who simply reads utmp and prints the USER_PROCESS entries: name, terminal line (pts/N for SSH and terminals, ttyN for consoles), login time and the remote host or display. With -u it stats the terminal device to compute idle time (time since anything was typed) and shows the PID of the session leader. who -b reads the BOOT_TIME record. who does not query sshd or systemd-logind, so sessions that never write utmp (su, sudo, non-interactive ssh commands, scp) don't appear, and a crashed session can leave a stale entry.
-HPrint column headings-uAdd idle time and session PID-bTime of last system boot-qOnly names and a user count-aEverything: boot, runlevel, login processes, users-rCurrent runlevel-TAdd + / - : whether the user accepts write/wall messagesam iOnly your own session (same as -m)FILERead another file, e.g. /var/log/wtmp for historyUsing who to see everyone who touched the serverwho shows only interactive sessions recorded in utmp. scp, sftp, ssh host 'cmd', cron and su don't appear.
Use last for history, journalctl -u ssh or /var/log/auth.log for every SSH auth, and auditd for commandsExpecting who am i to print root after sudo -iwho am i looks up the utmp entry for your terminal, which records the original login name.
Use whoami or id -un to see the current effective userTrusting an old who entry as a live sessionIf a session crashed, its utmp entry can be left behind.
Cross-check with who -u (the PID) and ps -p PID, or loginctl list-sessionsTry these on a Linux machine of your own. Each task has a hint and a solution.
List current sessions with column headings and idle times.
Show when the system was last booted.
Show only your own session, then compare with whoami after sudo -i.
whoList logged-in users
who lists the login sessions currently open on the machine: user, terminal, login time and where they connected from. It also tells you when the system last booted. Check it before a reboot and after a suspicious alert.
who [OPTION]... [FILE | am i]You need to reboot devops-lab for a kernel patch and want to know who you'd kick off.
whoReads the utmp login records (coreutils).
Login programs (sshd, login, terminal emulators, tmux) write a record to /var/run/utmp when a session starts and mark it dead when it ends; the same records are appended to /var/log/wtmp as history. who simply reads utmp and prints the USER_PROCESS entries: name, terminal line (pts/N for SSH and terminals, ttyN for consoles), login time and the remote host or display. With -u it stats the terminal device to compute idle time (time since anything was typed) and shows the PID of the session leader. who -b reads the BOOT_TIME record. who does not query sshd or systemd-logind, so sessions that never write utmp (su, sudo, non-interactive ssh commands, scp) don't appear, and a crashed session can leave a stale entry.
-HPrint column headings-uAdd idle time and session PID-bTime of last system boot-qOnly names and a user count-aEverything: boot, runlevel, login processes, users-rCurrent runlevel-TAdd + / - : whether the user accepts write/wall messagesam iOnly your own session (same as -m)FILERead another file, e.g. /var/log/wtmp for historyUsing who to see everyone who touched the serverwho shows only interactive sessions recorded in utmp. scp, sftp, ssh host 'cmd', cron and su don't appear.
Use last for history, journalctl -u ssh or /var/log/auth.log for every SSH auth, and auditd for commandsExpecting who am i to print root after sudo -iwho am i looks up the utmp entry for your terminal, which records the original login name.
Use whoami or id -un to see the current effective userTrusting an old who entry as a live sessionIf a session crashed, its utmp entry can be left behind.
Cross-check with who -u (the PID) and ps -p PID, or loginctl list-sessionsTry these on a Linux machine of your own. Each task has a hint and a solution.
List current sessions with column headings and idle times.
Show when the system was last booted.
Show only your own session, then compare with whoami after sudo -i.