who(1)

Output only information about the current terminal. This option is equivalent to the am i and am I options described above.

Lists only those users who are currently logged in. name is the user's login name. line is the name of the line as found in the directory /dev. The time field indicates when the user logged in.

activity is the number of hours and minutes since input activity last occurred on that particular line. A dot (.) indicates that the terminal has seen activity in the last minute and is therefore ``current''. If more than twenty-four hours have elapsed or the line has not been used since boot time, the entry is marked old. This field is useful when trying to determine whether a person is working at the terminal or not. The pid is the process-ID of the user's login process. The comment is the comment field associated with this line as found in /etc/inittab (see inittab(4)). This can contain information about where the terminal is located, the telephone number of the dataset, type of terminal if hard-wired, etc. If no such information is found, then who prints, as the comment, the user's host name as it was stored in the utmps database or named file. Note that the user's host name is printed instead of comments from the /etc/inittab file if the -u option is used in conjunction with the -R option.

Same as the -u option, except that the state of the terminal line is printed. state describes whether someone else can write to that terminal. A + appears if the terminal is writable by anyone; a - appears if it is not. root can write to all lines having a + or a - in the state field. If a bad line is encountered, a ? is printed.

(UNIX Standard only, see standards(5).) Only the following fields are displayed: name state line time

Lists only those lines on which the system is waiting for someone to login. The name field is LOGIN in such cases. Other fields are the same as for user entries except that the state field does not exist.

Prints column headings above the regular output.

A quick who, displaying only the names and the number of users currently logged in. When this option is used, all other options are ignored.

Lists any other process which is currently active and has been previously spawned by init. The name field is the name of the program executed by init as found in /etc/inittab. The state, line, and activity fields have no meaning. The comment field shows the id field of the line from /etc/inittab that spawned this process. See inittab(4).

This option displays all processes that have expired and have not been respawned by init. The exit field appears for dead processes and contains the termination and exit values of the dead process (as returned by wait() — see wait(2)). This can be useful in determining why a process terminated.

Indicates the time and date of the last reboot.

Indicates the current run-level of the init process. The last three fields contain the current state of init, the number of times that state has been previously entered, and the previous state. These fields are updated each time init changes to a different run state.

Indicates the last change to the system clock (via the date command) by root. See su(1).

Processes utmps database or the named file with all options turned on.

Default. Lists only the name, line, and time fields.

When the /var/adm/wtmp file is specified, (the -W option can be used to examine the /var/adm/wtmps file) this option indicates when the accounting system was turned on or off using the startup or shutacct commands (see acctsh(1M)). The name field is a dot (.). The line field is acctg on, acctg off, or a reason that was given as an option to the shutacct command. The time is the time that the on/off activity occurred.

Displays the user's host name. If the user is logged in on a tty, who displays the string returned from gethostname() (see gethostname(2)). If the user is not logged in on a tty and the host name stored in the utmps database or named utmp like file has not been truncated when stored (meaning that the entire host name was stored with no loss of information), it is displayed as it was stored. Otherwise, the gethostbyaddr() (IPv4) or getipnodebyaddr() (IPv6) function is called with the internet address of the host (see gethostent(3N)). The host name returned by gethostbyaddr() (IPv4) or getipnodebyaddr() (IPv6) is displayed unless it returns an error, in which case the truncated host name is displayed.

Gets the information from /var/adm/wtmps file.