Quickly see who is logged in, where from, and how long sessions have been idle. 16.11.2025 | reading time: 2 min The "who" command reports who is currently logged into the system; use it to answer questions like "who is on the box now" and "which terminals are active" quickly and reliably. Live case: tracing sessions Reproduce a simple investigation: run "who" to list active sessions and then ask about idle time and origins using the "-uH" option, for example: ``` $ who alice pts/0 2025-11-16 09:15 (192.0.2.10) bob pts/1 2025-11-16 09:20 (192.0.2.11) ``` and then: ``` $ who -uH USER LINE TIME IDLE PID COMMENT alice pts/0 2025-11-16 09:15 . 2345 (192.0.2.10) bob pts/1 2025-11-16 09:20 00:05 2350 (192.0.2.11) ``` Beyond the basics Use options to tailor output: "-H" adds a header, "-u" shows idle times, "-a" prints all available information, and you can point "who" at alternate utmp/wtmp files like "/var/log/wtmp" to inspect historical sessions; combine "who" with grepping for a username to find specific logins. Companion utilities For more context pair "who" with tools such as "w" to see load and processes, "last" to review past logins from wtmp, and "users" for a compact username list; each tool answers a slightly different question in session analysis. Final view Knowing "who" and its common switches speeds up troubleshooting, auditing and simple monitoring tasks; keep exploring allied commands and practice on live systems to build intuition and prepare for certifications like CompTIA Linux+ or LPIC-1 with intensive exam preparation at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. utilities processes troubleshooting
