who, w, and last: Inspecting Logins and Sessions

who, w, and last: Inspecting Logins and Sessions
Reading time: About 8 min Difficulty: Beginner

Who is using this server right now?

Lina: Senpai, I was working on a shared server and it suddenly got slow. Could someone else be logged in too? Can I even check that?
Linny-senpai: You can. Use who to see who is logged in right now, w to see what they are doing, and last to see who logged in in the past. These three go together nicely once you learn them.

What You'll Learn

  • How to list currently logged-in users with who
  • How to check each user's activity and server load with w
  • How to look back through past login history with last
  • How to inspect reboot and boot history with last reboot
  • When to use who/w (now) vs last (past)

1. What's the difference between who, w, and last?

Conclusion: who and w show who is logged in right now, while last shows past login history. w is more detailed than who and reveals what each user is doing.

Lina: Three commands sounds like a lot to keep straight.
Linny-senpai: Sort them into "now" vs "past" and it gets easy. who and w show the live login state; last shows history. who is the simple one, and w adds "what they're doing" on top of it.
Command What it shows Type of info
who Who is logged in now Now (live)
w Now + each user's activity Now (live, detailed)
last Past login history Past (log)

who and w read live session data (/var/run/utmp), while last reads an accumulated log (/var/log/wtmp). That's why only last can show people who have already logged out.

2. How do I see who is logged in now?

Conclusion: Just type who to list each logged-in user's name, terminal, and login time.

Lina: Let's start with "who is here right now."
Linny-senpai: Right, just type who on its own. No arguments or options needed.
$ who
lina     tty1         2026-06-05 09:12
linny    pts/0        2026-06-05 10:03 (192.168.1.20)
Lina: Two people. What are tty1 and pts/0?
Linny-senpai: Those are the terminals they logged in on. tty1 is a console attached directly to the machine; pts/0 is a virtual terminal over the network (like SSH). The (192.168.1.20) on the right is the source IP, shown for remote logins.

Columns (left to right)

  • Username
  • Terminal (tty = physical, pts = pseudo-terminal = remote connection)
  • Login date and time
  • Source host / IP (if any)
Lina: What if I just want to confirm "this session is me"?
Linny-senpai: Type who am i and you'll see only your own session line. Note the spaces — it's three separate words.
$ who am i
linny    pts/0        2026-06-05 10:03 (192.168.1.20)

who am i (with spaces, three words) and whoami (no spaces, one word) are different. whoami is a separate command that prints only your username; it is not an option of who. They're easy to mix up.

3. How do I see what each user is doing?

Conclusion: w adds to what who shows — for each user it displays the command they are running right now, plus the server's load average, all on one screen.

Lina: I want to know what's making it slow. Can I see what each person is actually doing?
Linny-senpai: That's exactly what w is for. The top line shows the overall server state, and each row below shows the command each user is running.
$ w
 10:15:32 up 2 days,  3:41,  2 users,  load average: 0.15, 0.10, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
lina     tty1     -                09:12    1:03m  0.20s  0.20s -bash
linny    pts/0    192.168.1.20     10:03    2.00s  0.10s  0.05s w
Lina: That top line is packed with information...
Linny-senpai: Left to right: the current time, uptime (up), how many users are logged in, and the load average. A higher load average means busier. The three numbers are averages over the last 1, 5, and 15 minutes.

Key columns in w

  • USER / TTY / FROM: who, which terminal, from where
  • LOGIN@: login time
  • IDLE: time since last activity (longer = more idle)
  • WHAT: the command running right now
Lina: So WHAT tells me I'm just sitting in -bash (a shell), and you're running w.
Linny-senpai: Exactly. You can guess who is putting load on the machine and with which task. Drop the header with w -h, or narrow to one user with w lina.
$ w -h lina
lina     tty1     -                09:12    1:03m  0.20s  0.20s -bash

4. How do I see past login history?

Conclusion: last shows past login history, newest first. It includes people who have already logged out, so you can trace who logged in, when, and from where.

Lina: What about looking at the past — like "who logged in last night" rather than "now"?
Linny-senpai: That's last. It lists login and logout records, newest first. There can be a lot, so start by limiting the count with -n.
$ last -n 5
linny    pts/0        192.168.1.20     Fri Jun  5 10:03   still logged in
lina     tty1                          Fri Jun  5 09:12   still logged in
linny    pts/0        192.168.1.20     Thu Jun  4 18:40 - 19:55  (01:15)
lina     pts/1        192.168.1.31     Thu Jun  4 14:02 - 17:30  (03:28)
reboot   system boot  6.8.0-generic    Thu Jun  4 08:00   still running
Lina: Some lines say still logged in and others say - 19:55 (01:15).
Linny-senpai: Good catch. still logged in means "still online now." 18:40 - 19:55 (01:15) means "logged in at 18:40, logged out at 19:55, for a duration of 1 hour 15 minutes." For past sessions you also get the logout time and duration.

last -n 5 shows only the 5 newest entries. last -5 does the same thing. History piles up, so narrowing the count first makes it much easier to read.

5. How do I check reboots or a specific user?

Conclusion: Use last reboot for reboot/boot history, and last username to filter to one user's logins.

Lina: There was a reboot line in that history. Can I see when the server rebooted?
Linny-senpai: Yes. last reboot lists just the boot times. Handy for tracking "when did it go down / come back up."
$ last reboot
reboot   system boot  6.8.0-generic    Thu Jun  4 08:00   still running
reboot   system boot  6.8.0-generic    Mon Jun  1 07:55 - Jun  4 07:58 (2+23:03)
Lina: And if I want just one person's history, say mine?
Linny-senpai: Add the username after last. last lina lists only lina's logins.
$ last lina
lina     tty1                          Fri Jun  5 09:12   still logged in
lina     pts/1        192.168.1.31     Thu Jun  4 14:02 - 17:30  (03:28)
lina     tty1                          Wed Jun  3 09:30 - 18:10  (08:40)

To inspect failed logins, use lastb (the btmp log), not last. lastb needs administrator privileges, so run sudo lastb. It helps you spot signs of intrusion, such as many failures from an unfamiliar IP.

Mini exercise (click to open)

Find out "how many users are logged in now" and "the 3 most recent login records," each with a different command.

Hint: The count appears in the header line of w (or the number of rows from who). For history, narrow to 3 entries with last -n 3.

6. Common pitfalls and fixes

Conclusion: Most trouble comes from three things: confusing whoami with who am i, misreading still logged in in last, and looking for failed logins with last.

Symptom Cause Fix
Only a username appears Using whoami Use who for a list, w for detail
who am i returns an error Wrong spacing Three words with spaces: who am i
last output is too long to read Showing the full history Limit with last -n 10
Failed logins don't show in last Looking at the success log (wtmp) See failures with sudo lastb (btmp)
Unsure what still logged in means Confused with the duration format It means "still online now"

When in doubt, follow this order: who is here now → who, what they're doing / load → w, look back into the past → last.

Next Reading