Linux who Command with Practical Examples

Introduction

In this lab, we will explore the Linux who command, which is a powerful tool for displaying information about currently logged-in users. We will understand the basic usage of the who command, learn how to filter its output, and explore the different fields it provides. This lab covers the topic of User and Permission Management, which is an essential skill for system administrators and users to understand the current activity on the system.

The lab consists of three main steps: Understand the who Command, Explore the Output of the who Command, and Filter the Output of the who Command. Through these steps, you will gain a comprehensive understanding of the who command and its practical applications.

Linux Commands Cheat Sheet

Skills Graph

Understand the who Command

In this step, we will explore the who command, which is a powerful tool in Linux for displaying information about currently logged-in users.

The who command provides information such as the username, terminal, login time, and the remote host from which the user has logged in. This information can be useful for system administrators and users to understand the current activity on the system.

Let's start by running the who command:

who

Example output:

labex   pts/0        2023-04-11 09:15 (172.17.0.1)

The output shows that the user labex is logged in on the pts/0 terminal, which was logged in at 2023-04-11 09:15 from the remote host 172.17.0.1.

The who command can also display additional information by using various options. Some common options include:

• who -a: Displays a more detailed output, including the idle time and the process ID of the user's shell.
• who -H: Displays a header line with the column names.
• who -q: Displays a quick list of users logged in, showing only the usernames.
• who am i: Displays information about the current user.

Let's try some of these options:

who -a

Example output:

labex   pts/0        2023-04-11 09:15 00:00   (172.17.0.1)

The -a option shows the idle time, which is 00:00 in this case, indicating that the user is actively using the terminal.

who -H

Example output:

NAME     LINE         TIME             COMMENT
labex    pts/0        2023-04-11 09:15  (172.17.0.1)

The -H option adds a header line to the output, making it easier to understand the meaning of each column.

who am i

Example output:

labex   pts/0        2023-04-11 09:15 (172.17.0.1)

The who am i command displays information about the current user.

Explore the Output of the who Command

In this step, we will dive deeper into the output of the who command and understand the different fields it provides.

Let's start by running the who command again:

who

Example output:

labex   pts/0        2023-04-11 09:15 (172.17.0.1)

The output of the who command consists of the following fields:

1. Username: The username of the logged-in user, in this case, labex.
2. Terminal: The terminal or session the user is logged in to, in this case, pts/0.
3. Login Time: The time the user logged in, in this case, 2023-04-11 09:15.
4. Remote Host: The remote host from which the user has logged in, in this case, (172.17.0.1).

Now, let's explore these fields in more detail:

Username: The username field displays the name of the user who is currently logged in. This is the same as the user you are logged in as, which in this case is labex.

Terminal: The terminal field shows the terminal or session the user is logged in to. In a typical Linux system, you might see values like tty1, pts/0, pts/1, etc. These represent different types of terminals or sessions.

Login Time: The login time field displays the date and time when the user logged in to the system.

Remote Host: The remote host field shows the IP address or hostname of the remote system from which the user has logged in. In this case, the user is logged in from the Docker container, so the remote host is shown as (172.17.0.1).

Let's try another example to see how the output changes when multiple users are logged in:

sudo useradd -m testuser
sudo su - testuser
who

Example output:

labex   pts/0        2023-04-11 09:15 (172.17.0.1)
testuser pts/1        2023-04-11 09:20 (172.17.0.1)

In this example, we created a new user testuser and switched to that user. The who command now shows two users logged in: labex and testuser.

Filter the Output of the who Command

In this step, we will learn how to filter the output of the who command to get specific information.

The who command can generate a lot of output, especially on a system with multiple users. To filter the output, we can use various command-line tools, such as grep, awk, and cut.

Let's start by filtering the output to show only the usernames:

who | awk '{print $1}'

Example output:

labex

The awk '{print $1}' command extracts the first field (the username) from the who command output.

Next, let's filter the output to show only the login times:

who | awk '{print $4, $5}'

Example output:

2023-04-11 09:15

The awk '{print $4, $5}' command extracts the fourth and fifth fields (the login date and time) from the who command output.

You can also use grep to filter the output based on specific criteria. For example, to show only the users logged in from a specific remote host:

who | grep '(172.17.0.1)'

Example output:

labex   pts/0        2023-04-11 09:15 (172.17.0.1)

The grep '(172.17.0.1)' command filters the output to show only the lines that contain the string (172.17.0.1), which represents the remote host.

These are just a few examples of how you can filter the output of the who command. You can combine these techniques to get the specific information you need.

Summary

In this lab, we explored the who command in Linux, which is a powerful tool for displaying information about currently logged-in users. We learned that the who command provides details such as the username, terminal, login time, and the remote host from which the user has logged in. We also discovered various options that can be used with the who command to customize the output, such as displaying a more detailed view, adding a header line, or showing only the usernames. Additionally, we learned how to use the who am i command to display information about the current user.

Linux Commands Cheat Sheet