who Command Purpose Identifies the users currently logged in. Syntax who [ -a | -b -d -h -i -l -m -p -q -H -T ] [ File ] -A -H -T ] [ File ] who am { i | I } Description The who command displays information about all users currently on the local system. The following information is displayed: login name, workstation name, date and time of login. Entering who am i or who am I displays your login name, workstation name, date and time you logged in. Note: If you execute who am i from a virtual terminal, the output is the same as for who am I, except that the workstation name and login time are not displayed. The who command can also display the elapsed time since line ac- tivity occurred, the process ID of the command interpreter (shell), logins, logoffs, restarts, and changes to the system clock, as well as other processes generated by the initialization process. The general output format of the who command is as follows: Name [State] Line Time [Activity] [Pid] [Exit] (Hostname) where: Name Is the user's login name. State Indicates whether the line is writable by everyone (see the -T flag). Line Is the line name as found in the /dev directory. Time Represents the time when the user logged in. Activity Represents the hours and minutes since activity last occurred on that user's line. A . (dot) here indicates line ac- tivity within the last minute. If the line has been quiet more than 24 hours or has not been used since the last system startup, the entry is marked as old. Pid Is the process ID of the user's login shell. Term Is the process termination status (see the -d flag). For more information on the termination values, refer to the wait subroutine or to the /usr/include/sys/signal.h file. Exit Is the exit status of ended processes (see the -d flag). Hostname Indicates the name of the machine the user is logged in from. To obtain information, the who command normally examines the /etc/utmp file. If you specify another file with the file param- eter, the who command examines that file instead. This new file is usually the /var/adm/wtmp or /etc/security/failedlogin file. Note: This command only identifies users on the local node. Flags -a Processes the /etc/utmp file or the named file with all in- formation. Equivalent to specifying the -AbdHlprTtu flags. -b Indicates the most recent system startup time and date. -d Displays all processes that have expired without being regen- erated by init. The exit field appears for dead processes and contains the termination and exit values (as returned by wait) of the dead process. (This flag is useful for determining why a process ended.) -h Displays a brief usage for options. -l Lists any login process. -m Displays information about the current terminal. The who -m command is equivalent to the who am i and who am I commands. -p Lists any active process that is currently active and has been previously generated by init. -q Prints a quick listing of users and the number of users on the local system. -r Indicates the current run-level of the process. -s Lists only the name, line, and time fields. This flag is the default; thus, the who and who -s commands are equivalent. -t Indicates the last change to the system clock by the root user using the date command. -u or -i Displays the user name, workstation name, login time, line activity, and process ID of each current user. -A Displays all accounting entries in the /etc/utmp file. These entries are generated through the acctwtmp command. -H Displays a header (title). -T or -w Displays the state of the workstation line and indicates who can write to that workstation as follows: + Writable by anyone. - Writable only by the root user or its owner. ? Bad line encountered. Exit Status This command returns the following exit values: 0 Successful completion. >0 An error occurred. Examples 1. To display information about who is using the local system node, enter: who Information similar to the following is displayed: joe hft/0 Jun 8 08:34 2. To display your user name, enter: who am i Information similar to the following is displayed: george hft/0 Jun 8 08:34 3. To display a history of logins, logouts, system startups, and system shutdowns, enter: who /var/adm/wtmp Information similar to the following is displayed: hank hft/0 Jun 8 08:34 (ausnix5) john hft/0 Jun 8 08:34 (JIKey) mary hft/0 Jun 8 08:22 (machine.austin.ibm) jan pts4 Jun 8 09:19 (puff.wisc.edu) 4. To display the run-level of the local system node, enter: who -r Information similar to the following is displayed: . run-level 2 Jun 8 04:15 2 0 s 5. To display any active process that is currently actively and has been previously generated by init, enter: who -p Information similar to the following is displayed: srcmstr . Jun 8 04:15 old 2896 cron . Jun 8 04:15 old 4809 uprintfd . Jun 8 04:15 old 5158 6. To process the /var/adm/wtmp file with the -AbdHlprTtu flags specified, enter: who -a /var/adm/wtmp Information similar to the following is displayed: Name ST Line Time Activity PID Hostname Term Exit console - . Jan 09 14:10 old 2246 id= rc . . Jan 09 14:10 old 2246 id= rc term=0 exit=0 srcmstr - . Jan 09 14:10 old 2007 id=srcmstr IP daemo - . Jan 09 14:10 old 4568 id=rctcpip . . Jan 09 14:10 old 4568 id=rctcpip term=0 exit=0 nick - hft/0 Jan 08 14:57 22:32 3638 . hft/0 Jan 08 14:57 22:32 3638 id= cons term=1 exit=0 console - hft/0 Jan 08 14:57 22:32 15419 id= cons . hft/0 Jan 08 14:57 22:32 15419 id= cons term=9 exit=0 root + pts/1 Jan 09 12:29 . 12995 (portia) . hft/0 Jan 09 13:56 22:32 3339 id= cons term=0 exit=0 console - hft/0 Jan 09 13:56 22:32 3437 id= cons . hft/0 Jan 09 13:56 22:32 3437 id= cons term=2 exit=0 Implementation Specifics This command is part of Asynchronous Terminal Emulation (ATE) in Base Operating System Extensions 2. Files /etc/utmp Contains user and accounting information. /etc/security/failedlogin Contains the history of all invalid logins. /var/adm/wtmp Contains the history of all logins since the file was last created. /usr/include/sys/signal.h Contains a list of termination values. Related Information The date command, mesg command, whoami command su command. The wait subroutine.