What command will display information about users currently logged in to the Linux system?

How to check how many users are logged in to the Linux system? There are few commands we can use to show currently logged in users in Linux Operating System.

The users command will print the usernames of the current logged in users.

users

One user could be listed more than once, if the user has logged in from more than one location. We can filter the output with the uniq command to get a unique entry for each user.

users | tr ' ' '\n' | uniq

Get the user count with wc command:

users | tr ' ' '\n' | wc -l

Get the unique user count:

users | tr ' ' '\n' | uniq | wc -l

who command

The who command provides detailed information about currently logged in users.

who
root     tty1         2017-07-17 19:21
user     pts/0        2017-07-17 19:23 (192.168.1.105)
root     pts/1        2017-07-17 19:24 (192.168.1.105)

The who command will show the username, tty (terminal used by the user) and logged in Time. Again, if a user have opened multiple terminals, the user will be listed multiple times.

The --count option will print all usernames and user count.

who --count
root user root
# users=3

The w Command

The w command provides even more detailed information about Linux logged in users.

w

Show a Listing of Last Logged in users

The last command shows the most recent successful logins to the Linux system.

last

Number of result can be defined with -n option. Following example will show five most recent successful logins.

last -n 5

As shown in the above screenshot three users are still logged in to the system.

Linux is a multi-user operating system that allows multiple users to access the system at the same time.

As a Linux system administrator, you have to check who are logged into the system before starting to work on any issues, especially when you have a team members spread across multiple locations. Because, if multiple users are making the changes in the same configuration file, it may create additional problems.

So, make sure nobody is currently working on the issue before you take it up. To avoid these things, we need to check who all are logged into the system and what are they doing.

In this tutorial, we will show you how to check the current logged-in users with several commands in Linux.

• Suggested Read: How to track successful and failed login attempts in Linux

Knowing more than one command to find the same information will not hurt you, and do not hesitate to check the alternate options.

Method-1: Checking logged-in users with ‘w’ command

‘w command’ shows who are logged-in and what are they doing. It displays information about current users on the machine by reading the file /var/run/utmp, and their processes /proc.

w command output comes with header information, which displays system activity such as current time, system up time, how many users are currently logged-in, and the system load (which averages for the past 1, 5, and 15 minutes)

w command contains the following values:

login user name, tty number, remote host, user’s login time, idle time, JCPU (time used by all processes attached to the tty), PCPU (time used by the current process), and which commands are currently being executed by the users. Please see below:

# w
 17:13:34 up  1:52,  1 user,  load average: 0.11, 0.18, 0.15
USER     TTY      FROM              [email protected]   IDLE   JCPU   PCPU WHAT
root     pts/0    203.99.204.108    15:22    6.00s  0.18s  0.00s w

Method-2: Identifying who is Logged-in using ‘who’ command

‘who command’ shows information about users who are currently logged in. It uses ‘/var/run/utmp’ & ‘/var/log/wtmp’ files to get those details.

• /var/run/utmp: It contains information about the users who are currently logged onto the system. Who command is used to fetch the information from the file.
• /var/log/wtmp: It contains historical utmp. It keeps the users login and logout history. The last command uses this file to display the information.

who command output contains the following values such as login user name, tty number, date & time, and remote host.

# who
root     pts/0        2017-05-31 15:22 (203.99.204.108)

Method-3: How to see Logged in users with ‘whoami’ command

whoami is basically the concatenation of the strings “who”,”am”,”i” as whoami. It displays the username of the current user. It’s similar to running the id command with the options -un as shown below:

# whoami
root

Also, when you use whoami with space (who am i) that will give you a different output. It will display more details compared to whoami command as shown below:

$ who am i
daygeek  pts/1        2019-06-17 22:01 (192.168.1.6)

“id” command prints user and group information for a specified username, but we can add -un option with the “id” command to display all the currently logged-in users as shown below:

# id -un
root

Method-4: Using users command

‘users command’ prints the usernames of users currently logged in to the current host. It uses /var/run/utmp & /var/log/wtmp files to get the details as shown below:

# users
root

Method-5: Show currently logged-in users with ‘finger’ command

‘finger’ is a utility, which allows users to see the information about system users (login name, home directory, name, how long they’ve been logged in to the system, etc.).

Finger utility is available in all major Linux distributions, but it doesn’t come installed by default. Use distribution package manager to install “finger” on your system.

$ finger
Login     Name       Tty      Idle  Login Time   Office     Office Phone
magi      daygeek    tty7        7  Jun  1 16:05 (203.99.204.108)

Bonus Tips

Additionally, you can use the following methods to identify who all are logged-in on your system:

Bonus Tips-1: How to show current logged-in users with ‘last’ command

‘last command’ shows a list of last logged in users by searching the data from /var/log/wtmp file. Also, it shows the system reboot information.

“last” command output contains login user name, tty number, remote host, date, login time, logout time, and the total duration (working time).

Run the following command to show who all logged-in today. Also, you can check who’s currently logged in by filtering with the “still logged in” string.

# last -p today
 linuxgee tty2         tty2             Thu Mar  4 14:27    gone - no logout
 linuxgee :            :                Thu Mar  4 14:27    gone - no logout

Bonus Tips-2: Manual Way to check who’s logged-in

Last but not the least, we can get a list of logged in users on Linux machine manually by using less commands or more commands or head command or tail command, followed by the log file location.

User authentication logs are located @ /var/log/secure for RHEL based systems & /var/log/auth.log for Debian based systems.

$ head -5 /var/log/auth.log
Jun  1 16:05:01 daygeek CRON[1944]: pam_unix(cron:session): session opened for user root by (uid=0)
Jun  1 16:05:01 daygeek CRON[1944]: pam_unix(cron:session): session closed for user root
Jun  1 16:05:44 daygeek lightdm: pam_unix(lightdm-greeter:session): session closed for user lightdm
Jun  1 16:05:44 daygeek lightdm: pam_unix(lightdm:session): session opened for user magi by (uid=0)
Jun  1 16:05:44 daygeek systemd: pam_unix(systemd-user:session): session opened for user magi by (uid=0)

Over to You

In this guide, you learnt how to find out who all are currently logged-in on your Linux system employing different commands.

If you found this article helpful, please do share with your friends and spread the knowledge. Please feel free to comment below if you have any queries/concerns. We will get back to you as soon as we can. Happy learning!