To see which login sessions a Linux system has recorded, use the who command. It reads login records, usually from utmp, and lists the sessions they contain.
I’ll explain its output fields and show how to select the session associated with standard input.
TL;DR
The who command lists login sessions recorded on a Linux system, with options for session details and system records.
- Run who -H to label the output columns.
- Use who -m for the session associated with standard input.
- Choose whoami for your effective account name, not a session list.
What Does the who Command Show?
The who command reads login records, usually from the system’s utmp file. An account can exist without an active login session.
Run who -H to see the column names. NAME is the login name, LINE is the terminal such as tty or pts, TIME is the recorded login time, and COMMENT may identify a remote host or display.
A local desktop session may show a display marker, while an SSH session can show a remote host. If the command prints only headings, it found no session rows.
How to Check Login Sessions with who
Run who without an option for the short session list, then add a switch when a specific view will answer your question.
Step 1: List recorded sessions
Start with the default output to check whether the system has session records to show. Add -H when the column meanings are not obvious.
who -H
The captured output was:
NAME LINE TIME COMMENT
The heading-only output leaves the session list empty. Each row, when present, identifies a login name, terminal and recorded time.
Step 2: Select the current terminal session
Use -m to select the user and host associated with the command’s standard input. The equivalent form is who am i.
who -m
A blank result is possible when standard input is not tied to a login terminal. An SSH or terminal login can provide that association.
Step 3: Check boot time and session count
Use -b to read the last boot record, or -q to print login names with a total. These options answer separate questions, so I use the focused one instead of -a when I need only one fact.
who -b; who -q
The output reports a boot time of 2026-10-07 15:17 and a count of zero login names. The count is not the number of accounts created on the system.
Step 4: Add idle and process details
The -u option adds idle-time and process information to each listed session.
who -u
With no rows to annotate, this option adds nothing to the display. Use a process monitor when you need a list of running work.
Common issues and what to do next
A session list does not identify who typed a past command. For the current process identity, use whoami, which prints the effective username.
If you expected rows, check whether the system writes utmp records and whether the shell is connected to a login terminal. SSH gives remote-login context, but missing accounting data can still leave the list empty.
Use these checks to choose the next command:
- Run w to inspect live activity and system load.
- Run last to inspect available historical login records.
- Use an audit source for command-execution history. Neither w nor last is a command-audit log.
Conclusion: Read Login Sessions in Context
Use who to inspect login sessions available in the system records, then choose a focused option such as -m, -b or -q for the fact you need. Read the GNU Coreutils who documentation for the full option list, and see the related whoami guide when you need the current process identity.
FAQ
These answers cover common questions about session output and identity.
What does who do in Linux?
It lists login sessions found in the system’s session accounting data, usually utmp.
Why does who show no users?
There may be no active sessions in the available utmp records, or the current environment may not provide a login-terminal association.
Does who show who ran a command?
No. who reports login sessions, not historical command execution. Use an audit or shell-history source appropriate to the system when investigating past commands.
What is the difference between who and whoami?
who lists recorded login sessions, while whoami prints the effective username of the current process.