Programs for finding people

Listing who is currently logged on

On a typical Linux system, there are numerous programs for finding out who is logged on, and what they are doing. Among these are who, w, and finger.

Example 8-6. Finding out who is logged on

$ who
thammond pts/0        May 28 10:14 (
agarvey  pts/1        May 30 11:44 (
hammond Jun  5 17:23         
thammond pts/3        May 28 12:26 (
dbindner pts/7        Jun 11 13:13 (
hammond  pts/9        Jun 11 11:08 (
$ w
 13:14:20 up 14 days, 19:31,  6 users,  load average: 2.07, 2.00, 1.98
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU  WHAT
thammond pts/0    vh225002.truman. 28May03  2:06m  0.33s  0.33s  -bash 
agarvey  pts/1    vh216601.truman. 30May03  9days  6.51s  6.51s  -bash 
hammond  vh225002 -                Thu17    0.00s 13days  0.13s  sshd           
thammond pts/3    vh225002.truman. 28May03  2:06m  0.55s  0.55s  -bash 
dbindner pts/7    modem65.ipv6.tru 13:13    0.00s  0.03s  0.02s  w 
hammond  pts/9    vh225002.truman. 11:08    1:58m  0.01s  0.01s  -bash 
$ finger
Login     Name               Tty      Idle  Login Time   Office     Office Phone
agarvey   Alan Garvey        pts/1      9d  May 30 11:44 (
dbindner  Donald J Bindner   pts/7          Jun 11 13:13 (
hammond   Todd Hammond      *vh22500        Jun  5 17:23
hammond   Todd Hammond       pts/9    1:59  Jun 11 11:08 (
thammond  Todd Hammond       pts/0    2:07  May 28 10:14 (
thammond  Todd Hammond       pts/3    2:06  May 28 12:26 (

The who, w, and finger commands return many of the same pieces of information, including the account name, the amount of idle time (i.e. how long since a key has been typed), and where the person is logged in from. Which of the commands you choose to use is mostly a matter of preference.

If you need to know who has been on recently, rather than than who is on at the moment, the last command can list that. It takes a single argument -n where n indicates you would like a listing of the n most recent logins.

Example 8-7. Using the last command

$ last -10
dknudson pts/8        0-1pool245-222.n Wed Jun 11 13:14 - 13:14  (00:00)    
dbindner pts/7        modem65.ipv6.tru Wed Jun 11 13:13 - 13:24  (00:10)    
dgarth   vh222005.tru                  Wed Jun 11 12:23 - 12:26  (00:02)    
dknudson pts/7        0-1pool245-222.n Wed Jun 11 12:20 - 12:46  (00:25)    
hammond  vh222005.tru                  Wed Jun 11 11:53 - 12:14  (00:21)    
cmj489   pts/7        :0.0             Wed Jun 11 11:34 - 11:35  (00:00)    
cmj489   :0                            Wed Jun 11 11:34 - 11:35  (00:00)    
hammond  vh222005.tru                  Wed Jun 11 11:09 - 11:15  (00:05)    
hammond  pts/9        vh225002.truman. Wed Jun 11 11:08   still logged in   
cmj489   pts/9        :0.0             Wed Jun 11 09:41 - 09:41  (00:00)    

wtmp begins Sun Jun  1 18:51:35 2003

Finding information about an individual

There are some situations where you would like more specific information about a particular account. For example, you may have happened across a terminal where the previous user has forgotten to logout. You can identify the user easily with who:

Example 8-8. Who am I?

$ who am i
dbindner pts/7        Jun 11 13:13 (

Perhaps you have found a file belonging to an account (say dbindner), or noticed that a particular user is using a lot of processor time. The finger command can conveniently place a name to the account. It can also tell you if that person has new email waiting for them on the system, or the last time they read it. Some systems can be fingered remotely as well, using a user@host syntax.

Example 8-9. Fingering a single account

$ finger dbindner
Login: dbindner                         Name: Donald J Bindner
Directory: /home/ldap/dbindner          Shell: /bin/bash
Office: Violette Hall 2244, 785-4258
On since Wed Jun 11 13:13 (CDT) on pts/7 from
No mail.
No Plan.
$ finger dbindner@limestone
Login: dbindner                         Name: Donald J Bindner
Directory: /home/dbindner               Shell: /bin/bash
Office: 2244 Violette Hall, 785-4258
On since Tue May 13 10:41 (CDT) on tty1    29 days 2 hours idle
     (messages off)
Last login Wed Jun 11 12:15 (CDT) on pts/1 from
Mail last read Wed Jun 11 13:07 2003 (CDT)

    Public key:
    Key fingerprint = 95B9 6D7A 3457 E0C7 4636  A9F9 2EE7 86CE 1B23 F31F

On some systems, the finger command has been disabled, but often much of the same information can be obtained from the /etc/passwd file using grep. For example:

Example 8-10. Grepping for finger information

$ grep "dbindner" /etc/passwd
dbindner:x:1000:1000:Donald J Bindner,2244 Violette Hall,785-4258,:/home/dbindner:/bin/bash