The who(1) command displays the currently logged in users. Options like ‘-b‘ (date and time of last boot) or ‘-r‘ (current run level) should be very familiar. But there are also a number of not so well-known options, such as ‘-d‘ (terminated or dead processes), ‘-p‘ (active processes started by init(1)) and others. Also not so well known is the possibility to specify a file in utmp format as an argument. Instead of reading the requested information from the file /etc/utmp (active system), the information is read from the specified file. This is particularly useful with wtmp files, as these are usually regularly rotated via log rotation.

The who(1) command provides an option for all defined utmp record types, to display them. Below is an overview of the types and associated who options:

1          RUN_LVL                     who –r

2         BOOT_TIME                who –b

3        OLD_TIME                     who –t

4        NEW_TIME                   who –t

5        INIT_PROCESS            who –p

6        LOGIN_PROCESS        who –l

7         USER_PROCESS         who, who –q, who –s, who –u

8         DEAD_PROCESS        who –d

9        ACCOUNTING              who –A