Linux: Find out who is logged in to the server

Is it possible to find out who is logged in to the server from command line? Yes, it is possible using a few Linux commands. Let’s explore how to detect user names logged into the Linux server.

3 Commands to Find out who is logged in to the server

w command

w command prints useful information about how many users are logged in inside the server, and what are their running processes. Example:

[[email protected]:~]w
21:36:01 up 274 days, 17:33, 1 user, load average: 0.19, 0.24, 0.29
ultrauser pts/0 20:46 0.00s 0.02s 0.00s sshd: ultrauser [priv]
[[email protected]:~]

To see more information about a certain user, you can run this command:

w user

Where user is the username. Example:

[webtech@localhost ~]$ w webtech
23:39:16 up 54 min, 1 user, load average: 0,48, 0,48, 0,41
webtech tty2 22:45 54:28 14:38 2.52s /opt/google/chrome/chrome --type=renderer --enable-features=*AutofillCreditCardSigninPromo<AutofillCr
[webtech@localhost ~]$

who command

who command is another command that can help to find out who is logged in to the server.

Output example:

[[email protected]:~]who
ultrauser pts/0 2017-01-29 20:46 (
[[email protected]:~]

You can also use -a option to print out all the full information. Output example:

[[email protected]:~]who -a
system boot 2016-04-30 05:03
run-level 3 2016-04-30 05:03
LOGIN tty1 2016-04-30 05:03 7200 id=1
LOGIN tty2 2016-04-30 05:03 7202 id=2
LOGIN tty3 2016-04-30 05:03 7204 id=3
LOGIN tty4 2016-04-30 05:03 7206 id=4
LOGIN tty5 2016-04-30 05:03 7208 id=5
LOGIN tty6 2016-04-30 05:03 7210 id=6
ultrauser + pts/0 2017-01-29 20:46 . 13648 (
pts/1 2017-01-27 08:45 24158 id=ts/1 term=0 exit=0
pts/2 2016-09-16 15:08 32364 id=ts/2 term=0 exit=0
pts/3 2017-01-04 17:09 15024 id=ts/3 term=0 exit=0
pts/2 2016-07-22 08:45 22855 id=/2 term=0 exit=0
pts/1 2016-10-03 16:41 25856 id=/1 term=0 exit=0
pts/4 2017-01-03 16:52 25470 id=ts/4 term=0 exit=0
pts/5 2017-01-03 13:31 26228 id=ts/5 term=0 exit=0
[[email protected]:~]

There many options to pass to the who command:

-a, --all same as -b -d --login -p -r -t -T -u
-b, --boot time of last system boot
-d, --dead print dead processes
-H, --heading print line of column headings
-l, --login print system login processes
--lookup attempt to canonicalize hostnames via DNS
-m only hostname and user associated with stdin
-p, --process print active processes spawned by init
-q, --count all login names and number of users logged on
-r, --runlevel print current runlevel
-s, --short print only name, line, and time (default)
-t, --time print last system clock change
-T, -w, --mesg add user's message status as +, - or ?
-u, --users list users logged in
--message same as -T
--writable same as -T
--help display this help and exit
--version output version information and exit

users command

users command prints the login names of the users that are currently logged into the system, but ordered and on a single line. users command reads information from utmp file.

Output example:

[[email protected]:~]users
ultrauser johndoe linuxuser2 alterego34

As you see, the ‘users’ command is very basic and you can not get too much information.

Finger Command

While finger command is not a command to find out who is logged in to the server, it can help you to retrieve user information if you need to know more details.

Output example:

[[email protected]:~]finger ultrauser
Login: ultrauser Name:  John Bonachon
Directory: /home/ultrauser Shell: /bin/bash
On since Sun Jan 29 20:46 (EST) on pts/0 from
No mail.
No Plan.

As you see, using finger command can help you to find out more information like type of shell used, home directory, real name, login username, and last time it was seen online.


About the Author: Martin Keler

Leave a Reply

Your email address will not be published. Required fields are marked *