Today another day of studying: who turn I type who -l who -l UUCP . Feb 22 15:57 0:14 488 LOGIN console Feb 22 15:57 0:07 494 zsmon . Feb 22 15:57 0:14 495 LOGIN console Feb 22 16:03 0:07 1011 (:0) first column is the name of line (ttymon) second is tty used third date of creation the fourth column? (488, 494, 1011..)

> **Possible Duplicate:** > [What is the exact difference between a 'terminal', a 'shell', a 'tty' and a 'console'?](https://unix.stackexchange.com/questions/4126/what-is-the-exact-difference-between-a-terminal-a-shell-a-tty-and-a-cons) I always see pts and tty when I use the who command but I never understand how they are different? Can somebody please explain me this?

If I connect via SSH to my Debian 12 Server from another Linux Server and run the **who -m** command, it displays the following:

test-user    pts/1        2024-01-24 11:13 (xx.xx.xx.xx)

But, if I connect from a Windows 11 computer, via Windows Terminal or using a third-party App to connect to the same Debian 12 Server using the same exact user and run the same **who -m** command, the date/time format display is different.

test-user    pts/0        Jan 24 11:15 (xx.xx.xx.xx)

I am running this line in the */etc/profile* to determine the IP address from the user on every login, but it doesn't work properly as the output is different and those spaces are altering the outcome.

myip=$(who -m | awk '{print substr($5, 2, length($5) - 2)}')

Is there a way to control the date/time output for the **who** command? What could be causing this behavior? _Update_ Running the locale command from: From Linux:

$locale

LANG=en_US.UTF-8
LANGUAGE=
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_PAPER="en_US.UTF-8"
LC_NAME="en_US.UTF-8"
LC_ADDRESS="en_US.UTF-8"
LC_TELEPHONE="en_US.UTF-8"
LC_MEASUREMENT="en_US.UTF-8"
LC_IDENTIFICATION="en_US.UTF-8"
LC_ALL=

From Windows 11

$locale

LANG=
LANGUAGE=
LC_CTYPE="POSIX"
LC_NUMERIC="POSIX"
LC_TIME="POSIX"
LC_COLLATE="POSIX"
LC_MONETARY="POSIX"
LC_MESSAGES="POSIX"
LC_PAPER="POSIX"
LC_NAME="POSIX"
LC_ADDRESS="POSIX"
LC_TELEPHONE="POSIX"
LC_MEASUREMENT="POSIX"
LC_IDENTIFICATION="POSIX"
LC_ALL=

Just to note that this behavior doesn't seem to happen with all the Linux Servers I connect to. It varies and it's explained in the solution below. As I understood the root cause as per the explanation below, I opted to use the suggestions and they both work for my use case.

I noticed by chance today that I had 2 users running on my Linux system. I do not know much about Linux users but I ended up running the “w” command that gave the following output when Firefox is running:

USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
main     seat0    login-           17:22    0.00s  0.00s  0.00s /usr/libexec/gdm-wayland-session --register-session gnome-session
main     tty2     tty2             17:22    8:01   2:50   0.21s /usr/lib64/firefox/firefox -contentproc -childID 28 -isForBrowser -prefsLen 30120 -prefMapSiz

I would like to ask the following: - Is it ok to have my username being mentioned twice? IE this is not a hack into my system or anything? - I assume “/gdm-wayland-session --register-session gnome-session” represents me logged into Rocky and this is normal - is this correct? - I dont understand why there would be a second instance of my username associated with “/usr/lib64/firefox/firefox” - I would assume there would be a single user “main” that is running firefox, not firefox running as second instance of my user name. Is this ok / normal? Is there anything to be concerned about here? Thanks ahead of time…

I'm working remotely on an embedded device running Buildroot. My colleagues are working on this same device, so it's important to know who else is logged in. For a previous project (running on a non-embedded Ubuntu machine) with the same conditions I used the w command (or alternatively who) for this. It shows a list of all active sessions. Including my own. However, I noticed that for this Buildroot platform who is not installed, and w doesn't output any sessions. Despite several sessions being active. It doesn't even list my own!

$ w
 00:35:25 up 8 min,  0 users,  load average: 0.04, 0.04, 0.00
USER     TTY        LOGIN@   IDLE   JCPU   PCPU WHAT

$ ps -aux | grep bash
username    585  0.0  1.7   3424  2084 pts/0    Ss   00:28   0:00 -bash
username    596  0.0  1.6   3352  2068 pts/1    Ss+  00:28   0:00 -bash
username    623  0.0  0.9   2636  1204 pts/0    S+   00:35   0:00 grep bash

Elsewhere on this site I read that it might be due to not having admin privileges. However, when executing with sudo, or even entirely from the root account, it still does not display anything. Any idea why this might be?

(Example screenshot taken from https://askubuntu.com/questions/1343872/ubuntu-shows-other-users-are-logged-in-whenever-i-shut-down-even-though-i-am-the) But my question is: how does the system know this? I have done sudo chmod o-r /var/run/utmp sudo chmod o-r /var/log/wtmp And I verified that my user cannot run w or who anymore: the command output is empty because of read permission denied in utmp and wtmp. So how does the system know this? Where is the information leaking?

Unlike Linuxae which outputs 2022-11-07 16:23, FreeBSD who command outputs Nov 7 16:23. How can I change the date format in the output of who either globally or just for the duration of the command? Example output of who on FreeBSD 13.1-p3, in the POSIX locale (the date format changes with the locale):

me               pts/1        Nov  7 13:06 (192.168.1.107 via mosh )
me               pts/2        Nov  7 13:07 (tmux(1988).%0)
me               pts/3        Nov  7 13:07 (tmux(1988).%1)
me               pts/4        Nov  7 13:07 (tmux(1988).%2)
me               pts/5        Nov  7 13:08 (tmux(1988).%3)
me               pts/7        Nov  8 07:09 (192.168.1.103 via mosh )
me               pts/8        Nov  7 13:08 (tmux(1988).%4)

Note that while the date format changes with the locale, the date string in the output [is created with strftime()](https://cgit.freebsd.org/src/tree/usr.bin/who/who.c#n197) using either %e %b %R or %b %e %R as format strings, which makes it impossible to "just use another locale".

I can understand the commands who and whoami, but what exactly happens when I type: who am i and who am I am on Ubuntu, nothing happens after them! Why doesn't Linux / UNIX reply with an error message (something on the line of "unknown arguments" for who), or just reply with the output of who?

When either the who -a -H or who -u -H commands are executed - and having many users logged through tty and ssh - the command works as expected. I did realise the COMMENT header appears **but** always empty. **Question** * What does the _comment_ header **exactly** represent? **Extra Questions** * From where should appear the data for the comment header? * Where and how to put a comment to see it later there? - it only if is possible or viable through a manual process

Through the man who appears the following for the -T option -T, -w, --mesg add user's message status as +, - or ? According with some tutorials, if is executed who -T should appears these symbols. In my case - appears for all the users logged through tty and + for all the users logged through ssh - nothing about ? What do the - + ? symbols represent with the -T option?

How to view all currently logged in users on Alpine Linux? It doesn't have who by default apk add who doesn't find any packages. Is there another package for Alpine that contains who? Or does it use some other utility for the same purpose? I tried to look at the docs but searches for "list users" and "logged in users" didn't seem to yield results

I'm using a Linux server with my whole team together. We all have sudo permission. As we know, we can kick someone off easily: who -u will list all of ssh logins with their PIDs and then kill -9 anyone. Now let's say some bad man wrote a bash script, which would loop all of login users and kick off all of them: while true do # kill -9 each PID in who -u done Also, the bad man configured the bash script with systemd so that it would be started automatically while booting or rebooting. Now, I think nobody could remote login anymore. My question is if there is some technique to solove this problem without reinstalling the OS.

I have a question, why when I write "who" in the Ubuntu terminal from Microsoft Store in Windows 10 show nothing instead of showing username, date and time.

mark@DESKTOP-UD9H17S:~$ who

and after enter I don't see anything In normal ubuntu, I see the username, date, time, etc. And how ubuntu from Microsoft Store works? It's like a virtual machine or something like that? And to get to the files to this Ubuntu I must write \\wsl$ and I see a folder with Ubuntu, but why I don't see a folder when my Ubuntu turned off? I only see when Ubuntu is running. What's happened with that files, I see that they still exist when I turn off and turn on Ubuntu, so where system keep them?

A shell script running on a batch server will ssh (ssh -n root@prodfs1) to the file server to run another shell script, but we'd like to run subsequent shell scripts back on the original batch server. The who command does not return the name of the server that initiated the process. Is there a command that will provide the server name of the parent process? Thanks.

The man page description of who command is who - show who is logged on But there exists a similar command whoami. The man page description of whoami is whoami - print effective userid Can anyone explain what exactly these commands do ? How are they different from each other ?

I am trying to find a way to get output format of who -b same as in linux but on OSX i get format as below. MAC

% locale | grep LC_TIME
LC_TIME="en_US.UTF-8"
% who -b
reboot   ~        Nov  4 08:52

LINUX

[root@jump-host1 ~]# who -b
         system boot  2020-10-28 07:53
[root@jump-host1 ~]#

LOCALE is same on both linux and mac. How to get same format as linux on mac output of who -b Also i found these properties are getting inherited when i do ssh to linux host is what i understood but when i run who -b as root i get the above output from linux. **OSX**

bash-3.2$ alias who;type who;ldd $(type -p who) 
bash: alias: who: not found
who is /usr/bin/who
bash: ldd: command not found
bash-3.2$

**LINUX**

[jump-host1 ~]$ alias who;type who;ldd $(type -p who) 
-bash: alias: who: not found
who is /usr/bin/who
	linux-vdso.so.1 =>  (0x00007ffc5aaa4000)
	libc.so.6 => /lib64/libc.so.6 (0x00007f62620b3000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f6262481000)

I'm an absolute scripting novice but I've been asked to create a script that checks how long a user has been logged in to a Linux server and if it's longer than, let's say, 5 hours, it would need an Exit status which can be picked up by our monitoring system and alert out. I don't want someone to write the script for me (I'm no cheat), but I'd appreciate as much advice as I can get. Has anyone had any experience with writing a shell script that would do this or something similar? Many thanks in advance.

On a SLES11, I can see the following output: $ who | grep -i FOOBARUSER FOOBARUSER ::ffff:127.0.0.1:3 Mar 2 09:52 (::ffff:127.0.0.1::ffff:127.0.0.1:3) FOOBARUSER ::ffff:127.0.0.1:3 Mar 2 09:52 (::ffff:127.0.0.1) $ date Sun Dec 8 22:01:58 CET 2019 $ id FOOBARUSER id: FOOBARUSER: No such user So this would mean, the FOOBARUSER logged in from localhost to localhost at "Mar 2"? **The Question**: But how is this possible? The current date is "Dec 8". Why is the "who" cmd displaying a current login date as "Mar 2"? And this user doesn't even exists, how it was able to log in? UPDATE, more detailed infos: # who | grep -i FOOBARUSER FOOBARUSER ::ffff:127.0.0.1:3 2017-03-02 09:52 (::ffff:127.0.0.1::ffff:127.0.0.1:3) # # lsof | grep -i FOOBARUSER # # ps auxw | grep -i FOOBARUSER | grep -v grep # # date Mon Dec 9 18:58:36 CET 2019 # # who -T | grep -i FOOBARUSER FOOBARUSER ? ::ffff:127.0.0.1:3 2017-03-02 09:52 (::ffff:127.0.0.1::ffff:127.0.0.1:3) # # grep --text -i FOOBARUSER /var/run/utmp |strings ::ffff:127.0.0.1:3 .1:3FOOBARUSER ::ffff:127.0.0.1 pts/23 p120 p157 p152 p160 p139 p107 p138 %xX3 ::ffff:127.0.0.1:3 ::ffFOOBARUSER ::ffff:127.0.0.1::ffff:127.0.0.1:3 ::ffff:127.0.0.1:4 .1:4i867930 ::ffff:127.0.0.1 p117 pts/187 /187 # # ls -lah /dev/pts/23 crw--w---- 1 FOOBARUSER2 tty 136, 23 2019-12-09 17:01 /dev/pts/23 # # stat /dev/pts/23 File: `/dev/pts/23' Size: 0 Blocks: 0 IO Block: 1024 character special file Device: ch/12d Inode: 26 Links: 1 Device type: 88,17 Access: (0620/crw--w----) Uid: (3854620/ FOOBARUSER2) Gid: ( 5/ tty) Access: 2019-12-09 17:00:59.006679171 +0100 Modify: 2019-12-09 17:01:24.174902065 +0100 Change: 2019-12-09 16:57:22.022775177 +0100 # # grep --color -i 'pts/23' /var/log/messages # Looks like the "2017-03-02 09:52" is constant. Maybe this is a bug and this user isn't logging in actually?? Could the "/dev/pts/23" mean the PTS that the FOOBARUSER using?

I like to get an output on the screen of the who command, buth with the current date on the first line (without the use of a script) Following does the job, buth I prefer one command. $ who > who $ date > date $ cat date who Thanks.

When I entered who am i on my terminal, there is no output, no matter whether I use bash or zsh. But with XTerm, who am i prints my login info. Why does this happen? What difference does zsh or bash or XTerm make? I use Ubuntu 18.04 currently.