who(C)                          19 June 1992                          who(C)


 Name

    who - list who is on the system

 Syntax

    who [ -uATHldtasqbrfp ] [ file ]

    who am i

    who am I

 Description

    The who command can list the user's name, terminal line, login time, and
    the elapsed time since activity occurred on the line; it also lists the
    process ID of the command interpreter (shell) for each current user.  It
    examines the /etc/inittab file to obtain information for the Comments
    column, and /etc/utmp to obtain all other information.  If file is given,
    that file is examined.  Usually, file will be /etc/wtmp, which contains a
    history of all the logins since the file was last created.

    who with the am i or am I option identifies the invoking user.

    Except for the default -s option, the general format for output entries
    is:

       name [state] line time activity pid [comment] [exit]

    With options, who can list logins, logoffs, reboots, and changes to the
    system clock, as well as other processes spawned by the init process.
    These options are:

    -u    This option lists only those users who are currently logged in.
          The ``name'' is the user's login name.  The ``line'' is the name of
          the line as found in the directory /dev.  The ``time'' is the time
          that the user logged in.  The ``activity'' is the number of hours
          and minutes since activity last occurred on that particular line.
          A dot (.)  indicates that the terminal has seen activity in the
          last minute and is therefore ``current.''  If more than twenty-four
          hours have elapsed or the line has not been used since boot time,
          the entry is marked ``old.'' This field is useful when trying to
          determine whether a person is working at the terminal or not.  The
          ``pid'' is the process ID of the user's shell.  The ``comment'' is
          the comment field.  It can contain information about where the ter-
          minal is located, the telephone number of the dataset, the type of
          terminal if hard-wired, etc.

    -A    This option displays UNIX accounting information.

    -T    This option is the same as the -u option, except that the ``state''
          of the terminal line is printed.  The ``state'' describes whether
          someone else can write to that terminal.  A plus character (+)
          appears if the terminal is writable by anyone; a minus character
          (-) appears if it is not.  root can write to all lines having a
          plus character or a minus character in the ``state'' field.  If a
          bad line is encountered, a question mark (?) is displayed.

    -H    This option displays column headings above the regular output.

    -l    This option lists only those lines on which the system is waiting
          for someone to login.  The ``name'' field is LOGIN in such cases.
          Other fields are the same as for user entries except that the
          ``state'' field does not exist.

    -d    This option displays all processes that have expired and have not
          been respawned by init.  The ``exit'' field appears for dead pro-
          cesses and contains the termination and exit values (as returned by
          wait(C)), of the dead process.  This can be useful in determining
          why a process terminated.

    -t    This option indicates the last change to the system clock (via the
          date(C)command) su(C).

    -a    This option processes the /etc/utmp file or the named file with all
          options turned on.

    -s    This option is the default and lists only the ``name'', ``line'',
          and ``time'' fields.

    -q    This is a quick who, displaying only the names and the number of
          users currently logged on.  When this option is used, all other
          options are ignored.

    -b    This option indicates the time and date of the last reboot.

    -r    This option indicates the current run level of the init process.
          In addition, it produces the process termination status, process
          id, and process exit status (see utmp(F)) under the ``idle'',
          ``pid'', and ``comment'' headings, respectively.

    -f    The -f option will suppress psuedo-ttys from who output, except for
          remote logins.

    -p    This option lists any other process which is currently active and
          has been previously spawned by init.  The ``name'' field is the
          name of the program executed by init as found in /etc/inittab.  The
          ``state'', ``line'', and ``idle'' fields have no meaning.  The
          ``comment'' field shows the ``id'' field of the line from
          /etc/inittab that spawned this process.  See inittab(F).

 Files

    /etc/utmp
    /etc/wtmp
    /etc/inittab

 See also

    date(C), inittab(F), login(M), mesg(C), su(C), utmp(F), wait(S)

 Standards conformance

    who is conformant with:

    AT&T SVID Issue 2;
    and X/Open Portability Guide, Issue 3, 1989.