On a shared server, or one with several admins, you often need to know who’s logged in right now, from where, and what they’re doing, before rebooting, for example, or while investigating something odd. who and w answer that in a second.

who

who
alice    pts/0   2026-11-05 09:14 (203.0.113.50)
bob      pts/1   2026-11-05 10:02 (198.51.100.20)

Columns: user, terminal (pts/N = remote/pseudo terminal, tty1 = local console), login time, and source address.

Useful options:

who -b        # last system boot time
who -r        # current runlevel/target
who -q        # just names and a count
who am i      # your own session
whoami        # your effective user name

w: who, plus what they’re doing

w
 10:15:22 up 12 days,  3:41,  2 users,  load average: 0.12, 0.08, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
alice    pts/0    203.0.113.50     09:14    0.00s  0.05s  0.00s w
bob      pts/1    198.51.100.20    10:02    5:12   0.30s  0.25s vim /etc/nginx/nginx.conf
  • The header is the same as uptime: time, uptime, user count, and load averages. See uptime and load average.
  • IDLE: time since the user last typed something.
  • JCPU / PCPU: CPU time used by all processes on that terminal / by the current process.
  • WHAT: the command currently running in that session.
w -h          # no header
w bob         # one user

Seeing bob editing nginx.conf tells you not to reload Nginx right now.

Other ways to list sessions

users                     # just names
loginctl list-sessions    # systemd's view (includes non-terminal sessions)
loginctl session-status 3
ps -ef | grep sshd        # SSH session processes
ss -tnp | grep ':22'      # established SSH connections

See ss and netstat.

Messaging logged-in users

Before maintenance:

sudo wall "Server will reboot at 22:00 UTC for updates. Save your work."
write bob pts/1     # message one user (end with Ctrl+D)

shutdown also broadcasts a message: sudo shutdown -r +10 "Rebooting for kernel update".

Disconnecting a session

sudo pkill -KILL -t pts/1            # kill everything on that terminal
sudo loginctl terminate-session 3    # systemd way
sudo pkill -u bob                    # all of bob's processes (careful)

If you see a session you don’t recognise, don’t just kill it. First record its details (w, ps -ft pts/N, ss -tnp), check login history, and treat it as a possible compromise. See check login history and detect a compromised server.

Where the data comes from

who and w read /var/run/utmp, the list of current sessions. Login history is in wtmp (see last). Programs that don’t register in utmp (some tmux setups, non-interactive SSH commands, Docker exec) may not show up. Check ps and ss for a complete picture. See tmux.

Before a reboot or maintenance

A short routine avoids surprising colleagues: run w to see who’s connected and what they’re running, send a wall message with the planned time, wait for editors and long-running jobs to finish, then schedule the reboot with shutdown -r +10, which warns everyone again. Check tmux ls and screen -ls for detached sessions with work in progress, too.

Quick reference

Task Command
Who’s logged in who
Who + what + idle w
Boot time who -b
systemd sessions loginctl list-sessions
Broadcast message wall "text"
End a session loginctl terminate-session <id>

Related: kill a process on Linux and htop guide.

  • Linux
  • Command Line
  • Administration