Linux is a multi-user operating system that allows multiple users to access a system at the same time.
As a Linux system administrator, you have to check who is logged in the system before start working in any issues, when you have a team members across multiple location. Because if multiple users are making the changes in the same configuration file may create other additional problems.
So, make sure nobody is currently working on the issue before you start working on it. To avoid such kind of things, we need to check who’s logged in the system and what they are doing.
In this tutorial, we will show you how to check currently logged-in users with several commands in Linux.
- Suggested Read: How to track successful and failed login attempts in Linux
Knowing more than one command to find the same information will not hurt you, and do not hesitate to check the possible options.
Method-1: Checking logged-in user with w command
‘w command’ shows who’s logged on and what they are doing. It displays information about current users on the machine by reading the file
/var/run/utmp, and their processes
w command output comes with header which displays system activity such as current time, system up time, how many users are currently logged on, and the system load averages for the past 1, 5, and 15 minutes.
w command contains the following values login user name, tty number, remote host, user’s login time, idle time, JCPU (time used by all processes attached to the tty), PCPU (time used by the current process), and which command users performing currently.
# w 17:13:34 up 1:52, 1 user, load average: 0.11, 0.18, 0.15 USER TTY FROM [email protected] IDLE JCPU PCPU WHAT root pts/0 18.104.22.168 15:22 6.00s 0.18s 0.00s w
Method-2: Identifying who is Logged-in using who command
‘who command’ shows information about users who are currently logged in. It uses ‘/var/run/utmp’ & ‘/var/log/wtmp’ files to get the details.
/var/run/utmp:It contains information about the users who are currently logged onto the system. Who command is used to fetch the information from the file.
/var/log/wtmp:It contains historical utmp. It keeps the users login and logout history. The last command uses this file to display the information.
who command output contains the following values such as login user name, tty number, date & time, and remote host.
# who root pts/0 2017-05-31 15:22 (22.214.171.124)
Method-3: How to see Logged in users with whoami command
whoami is basically the concatenation of the strings “who”,”am”,”i” as whoami. It displays the username of the current user . It’s similar as running the id command with the options -un.
# whoami root
Also, when you use whoami with space (who am i) that will give you a different output. It’s giving more details compared with whoami command.
$ who am i daygeek pts/1 2019-06-17 22:01 (192.168.1.6)
id command print user and group information for the specified username, but we can add
-un options with id command to get current logged in users.
# id -un root
Method-4: Using users command
‘users command’ prints the usernames of users currently logged in to the current host. It uses
/var/log/wtmp files to get the details.
# users root
Method-5: Show currently logged-in users with finger command
‘finger’ is a utility, which allows users to see the information about system users (login name, home directory, name, how long they’ve been logged in to the system, etc.).
Finger utility available in all major Linux distribution and doesn’t installed by default. Use distribution package manager to install finger on your system.
$ finger Login Name Tty Idle Login Time Office Office Phone magi daygeek tty7 7 Jun 1 16:05 (126.96.36.199)
Additionally, you can use the following methods to identify who’s logged-in your systems.
Bonus Tips-1: How to show current logged-in users with last command
‘last command’ show list of last logged in users by searching the data from
/var/log/wtmp file. Also it shows system reboot information.
last command output contains login user name, tty number, remote host, date, login time, logout time, and total duration (working time).
Run the following command to show who has logged-in today. Also, can check who’s currently logged in by filtering with “still logged in” string.
# last -p today linuxgee tty2 tty2 Thu Mar 4 14:27 gone - no logout linuxgee : : Thu Mar 4 14:27 gone - no logout
Bonus Tips-2: Manual Way to check who’s logged-in
Last but not least, we can get the list of logged in users on Linux machine with manual way by using less command or more command or head command or tail command with followed by the log file location.
User authentication logs are located @
/var/log/secure for RHEL based systems &
/var/log/auth.log for Debian based systems.
$ head -5 /var/log/auth.log Jun 1 16:05:01 daygeek CRON: pam_unix(cron:session): session opened for user root by (uid=0) Jun 1 16:05:01 daygeek CRON: pam_unix(cron:session): session closed for user root Jun 1 16:05:44 daygeek lightdm: pam_unix(lightdm-greeter:session): session closed for user lightdm Jun 1 16:05:44 daygeek lightdm: pam_unix(lightdm:session): session opened for user magi by (uid=0) Jun 1 16:05:44 daygeek systemd: pam_unix(systemd-user:session): session opened for user magi by (uid=0)
Over to You
In this guide, you learned how to check who’s currently logged-in Linux system with several ways.
If you have any questions or feedback, feel free to comment below.