7 October 2026 · One command a day

How do I see who is logged in to my Linux server right now?

The who command lists every user who has an open login session on your server right now. Use it when you want to know whether anyone else is connected, or when something odd happens and you want to check who might be causing it. It runs in under a second and needs no setup.

The command

who -H -u

who on its own reads the system's record of current login sessions and prints one line for each. -H adds a header row so you can tell the columns apart. -u adds two useful columns: how long each session has been idle, and the process ID (PID) of the login. You do not need sudo. Any user can run it.

What you will see

NAME     LINE         TIME             IDLE          PID COMMENT
root     pts/0        2026-10-07 09:14   .          4821 (127.0.0.1)
deploy   pts/1        2026-10-07 07:52 01:16        3907 (127.0.0.1)

Each row is one session. NAME is the account that logged in. LINE is the terminal; pts/ means a remote session such as SSH. TIME is when the session started. IDLE shows a dot if the session was active in the last minute, hours and minutes if it has been quiet, or old if it has been idle for more than a day. PID is the login process. COMMENT is where the connection came from, usually an IP address. On a real server you will see your own public IP here, and you should recognise every address in the list.

When to use it

• Before you reboot or restart SSH, to make sure nobody else is in the middle of something.
• When you get a security alert or see strange activity, to check whether an unknown account or IP is connected right now.
• When you share a server with a colleague or contractor, to see whether they are still logged in after their work should have finished.

Watch out for

who only shows interactive login sessions. A connection that runs a single command, such as ssh user@host 'uptime', a deploy script, or an scp or SFTP file transfer, usually does not appear. An empty list therefore does not prove nobody is connected. To see every open SSH connection, check the sockets instead with sudo ss -tnp state established '( sport = :22 )'. For logins that have already ended, use the last command.

Questions people ask

What is the difference between who and w?

w shows the same sessions but adds the command each user is currently running and the server's load average. who is shorter and easier to read when you only want to know who is connected.

How do I end someone else's session?

Take the PID from who -u and run sudo kill 3907, using that session's PID. If you do not recognise the user, also remove their SSH key or change the password before they reconnect, and check which IPs fail2ban has banned.

Seeing exactly who is on the machine is something you can only do on a server you control, not on shared hosting. You can get the same VPS with 20% off at https://asksteves.co.uk/vps. Affiliate link.