who Command

Purpose

Identifies the users who are currently logged in.

Syntax

who [ -a | -b -d -i -l -m -p -q -r -s -t -u -w -A -H -T -X ] [ File ]

who am { i | I }

Description

The who command displays information about all users currently on the local system. The following information is displayed: login name, tty, date, and time of login. Typing who am i or who am I displays your login name, tty, date, and time you logged in. If the user is logged in from a remote machine, then the hostname of that machine is displayed as well.

The who command can also display the elapsed time since line activity occurred, the process ID of the command interpreter (shell), logins, logoffs, restarts, changes to the system clock, and changes in other processes generated by the initialization process.

The who command displays the output in the following format:

Name [State] Line Time [Activity] [Pid] [Exit] (Hostname)

The following table describes the fields that are displayed in the who command output:

Table 1. who command output fields
Item	Description
`Name`	Identifies the user's login name.
`State`	Indicates whether the line is writable by everyone (see the -T flag).
`Line`	Identifies the line name as found in the /dev directory.
`Time`	Represents the time when the user logged in.
`Activity`	Represents the hours and minutes since activity last occurred on that user's line. A `.` (dot) here indicates line activity within the last minute. If the line is quiet for more than 24 hours or is not used since the last system startup, the entry is marked as old.
`Pid`	Identifies the process ID of the login shell of the user.
`Term`	Identifies the process termination status (see the -d flag). For more information on the termination values, refer to the wait subroutine or to the /usr/include/sys/signal.h file.
`Exit`	Identifies the exit status of ended processes (see the -d flag).
`Hostname`	Specifies the name of the machine that the user is logged in from.

To obtain information, the who command usually examines the /etc/utmp file. If you specify another file with the File parameter, the who command examines that file instead. This new file is usually the /var/adm/wtmp or /etc/security/failedlogin file.

If the File parameter specifies more than one file name, only the last file name is used.

Note: This command identifies only users on the local node.

Flags

Table 2. Flags
Item	Description
-a	Processes the /etc/utmp file or the named file with all information. Equivalent to specifying the -bdlprtTu flags.
-b	Indicates the most recent system startup time and date.
-d	Displays all processes that expired without getting regenerated by `init`. The exit field appears for dead processes and contains the termination and exit values (as returned by wait) of the dead process. (This flag is useful for determining why a process ended by looking at the error number returned by the application.)
-l	Lists any login process.
-m	Displays information about the current terminal only. The who -m command is equivalent to the who am i and who am I commands.
-p	Lists any active process that is currently active and is previously generated by `init`.
-q	Prints a quick listing of users and the number of users on the local system.
-r	Indicates the current run-level of the process.
-s	Lists only the name, line, and time fields. This flag is the default; thus, the who and who -s commands are equivalent.
-t	Indicates the last change that were done by the root user to the system clock by using the date command. If the date command is not run since system installation, the who -t command produces no output.
-u or -i	Displays the username, tty, login time, line activity, and process ID of each current user.
-A	Displays all accounting entries in the /etc/utmp file. These entries are generated through the acctwtmp command.
-H	Displays a header (title).
-T or -w	Displays the state of the tty and indicates who can write to that tty. `+` Writable by anyone. `-` Writable only by the root user or its owner. `?` Bad line encountered.
-X	Prints all available characters of each username instead of truncating to the first 8 characters. The username is also moved to the last column of the output.

Exit status

This command returns the following exit values:

Table 3. Exit status
Item	Description
0	Successful completion.
>0	An error occurred.

Examples

1. To display information about who is using the local system node, enter the following command:
```
who
```
Information similar to the following output is displayed:
```
pts/1      Nov  9 00:20   long_username_greater_than_eight_characters  (localhost)
```
To display your username, enter the following command:
```
who am i
```
Information similar to the following output is displayed:
```
george lft/0 Jun 8 08:34
```

To display a history of logins, logouts, system startups, and system shutdowns, enter the following command:

who /var/adm/wtmp

Information similar to the following output is displayed:

hank   lft/0   Jun   8   08:34  (ausnix5)
john   lft/0   Jun   8   08:34  (JIKey)
mary   lft/0   Jun   8   08:22  (machine.austin.ibm)
jan    pts4    Jun   8   09:19  (puff.wisc.edu)

To display the run-level of the local system node, enter the following command:
```
who  -r
```
Information similar to the following output is displayed:
```
. run-level 2 Jun 8 04:15 2 0 s
```
To display any active process that is currently actively and is previously generated by init, enter the following command:
```
who  -p
```
Information similar to the following output is displayed:
```
srcmstr   .    Jun 8  04:15  old  2896
cron      .    Jun 8  04:15  old  4809
uprintfd  .    Jun 8  04:15  old  5158
```

To process the /var/adm/wtmp file with the -bdlprtTu flags specified, enter the following command:

who  -a /var/adm/wtmp

Information similar to the following output is displayed:


   .        system boot Jun 19 10:13        
   .        run-level 2 Jun 19 10:13        
   .            .       Jun 19 10:14    old 
   .            .       Jun 19 10:14    old 
   .            .       Jun 19 10:14    old 
rc        -     .       Jun 19 10:13    old 
   .            .       Jun 19 10:16    old 
   .            .       Jun 19 10:14    old 
srcmstr   -     .       Jun 19 10:14    old 
rctcpip   -     .       Jun 19 10:14    old 
rcdce     -     .       Jun 19 10:14    old 
rccm      -     .       Jun 19 10:15    old 
dceupdt   -     .       Jun 19 10:15    old 
rcnfs     -     .       Jun 19 10:15    old 
cron      -     .       Jun 19 10:16    old 
piobe     -     .       Jun 19 10:16    old 
qdaemon   -     .       Jun 19 10:16    old 
writesrv  -     .       Jun 19 10:16    old 
uprintfd  -     .       Jun 19 10:16    old 
   .            .       Jun 19 10:16    old 
LOGIN     - lft0        Jun 19 10:16    old 
   .            .       Jun 19 10:16    old 
   .            .       Jun 19 10:16    old

Files

Table 4. Files
Item	Description
/etc/utmp	Contains user and accounting information.
/etc/security/failedlogin	Contains the history of all invalid logins.
/var/adm/wtmp	Contains the history of all logins since the file was last created.
/usr/include/sys/signal.h	Contains a list of termination values.