How To Find Who Is Logged On Your System And What They Are Doing

If you’re managing a multi-user server, you might often need to find who is logged on your system and what they are doing. In Unix-like systems, there is single letter command called ‘w’, which is used to display the information about the users currently on the server, and their processes. This command is very useful when you are managing a shared server that is frequently being accessed by many users. You can track all of them without having to use any additional tools or applications. The 'w' command will show the details including, the current time, how long the system has been running, how many users are currently logged on, and the system load averages for the past 1, 5, and 15 minutes .

In this brief guide, we will see how to use 'w' command to monitor the users in Linux.

Find who is logged on your system Using "w" command

The typical usage of w command is:

$ w [options] user

Let us see some practical examples.

Type ‘w’ in the command prompt to see who is logged on your server.

$ w

Sample output:

12:48:40 up 2 min, 4 users, load average: 0.31, 0.35, 0.15
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root tty1 12:46 2:00 0.09s 0.09s -bash
sk pts/0 sk 12:47 1:26 0.04s 0.04s -bash
ostechni pts/1 sk 12:47 1:04 0.04s 0.04s -bash
root pts/2 sk 12:47 0.00s 0.05s 0.00s w

As you can see in the above output, The "w" command displays the following details of each user logged in your server.

• login name
• the tty name
• the remote host
• login time
• idle time
• JCPU, PCPU time
• the command line of their current process.

Here, JCPU time is the time used by all processes attached to the tty, and PCPU time is the time used by the current process, named in the "what" field.

If you don’t want to print the header, just use -h option like below.

$ w -h

You will see an output something like below.

root tty1 12:46 2:29 0.09s 0.09s -bash
sk pts/0 sk 12:47 1:55 0.04s 0.04s -bash
ostechni pts/1 sk 12:47 1:33 0.04s 0.04s -bash
root pts/2 sk 12:47 5.00s 0.06s 0.01s w -h

As see you in the above results, The 'w' command displays all users' details. You can also view a particular user’s details by using -u option like below.

$ w ostechnix

Sample output would be:

12:56:39 up 10 min, 4 users, load average: 0.00, 0.08, 0.10
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
ostechni pts/1 sk 12:47 2:15 0.05s 0.05s -bash

Also, you can display IP address instead of hostname for "FROM" (remote hostname) field using -i option as shown below.

$ w -i

Sample output:

12:58:31 up 12 min, 4 users, load average: 0.07, 0.08, 0.10
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root tty1 12:46 11:51 0.09s 0.09s -bash
sk pts/0 192.168.43.192 12:47 8:39 0.04s 0.04s -bash
ostechni pts/1 192.168.43.192 12:47 4:07 0.05s 0.05s -bash
root pts/2 192.168.43.192 12:47 7.00s 0.08s 0.01s w -i

Here, 192.168.43.192 is the system where I am accessing my server via ssh.

For more details, refer the man pages.

$ man w

You know now how to check who is logged on your server and what they are up to. If you find this guide useful, please share it on your social and professional networks and support us.

Cheers!