who, w, and last: Inspecting Logins and Sessions

who, w, and last: Inspecting Logins and Sessions
Reading time: About 8 min Difficulty: Beginner

What you'll be able to do

  • Check who is logged in now and what each of them is doing with `who` and `w`
  • Trace past logins and reboot history with `last`
  • Choose between the commands that show "now" and the one that shows "the past"

Prerequisites (read these first)

Who is using this server right now?

Lina: Senpai, I was working on a shared server and it suddenly got slow. Could someone else be logged in too? Can I even check that?
Linny-senpai: You can. Use who to see who is logged in right now. Use w to see what they are doing. Use last to see who logged in in the past.
Lina: Three commands, then.
Linny-senpai: Right. Learn them as a set and they go together nicely.

Learn the escape route first: when the screen looks stuck

last prints a lot of history. The output can scroll on and on, as if it will never stop. Here is how to get out.

What you see How to get out
Output scrolls on and never ends Press Ctrl+C to stop it
A : or (END) appears and it pauses A pager is running - the tool that shows long output one screen at a time, such as less. Press q to leave it
who prints nothing at all Not a failure. Nobody is logged in. On WSL or in a container the record file can simply be empty
You never wanted that much output Limit the count up front: last -n 5

who, w, and last only display information. Running them changes no settings, so try them without worry.

What You'll Learn

  • How to list currently logged-in users with who
  • How to check each user's activity and server load with w
  • How to look back through past login history with last
  • How to inspect reboot and boot history with last reboot
  • When to use who/w (now) vs last (past)

1. What's the difference between who, w, and last?

Conclusion: who and w show who is logged in right now, while last shows past login history. w is more detailed than who and reveals what each user is doing.

Lina: Three commands sounds like a lot to keep straight.
Linny-senpai: Sort them into "now" vs "past" and it gets easy. who and w show the live login state, and last shows history.
Linny-senpai: On top of that, who is the simple one. w adds "what they're doing" to the same picture.

What a session is

A session is one continuous stretch of use, from the moment a user logs in until they log out. "Login session" and "connection" are used for much the same idea. If the same person logs in from two places, that is two sessions.

Command What it shows Type of info
who Who is logged in now Now (live)
w Now + each user's activity Now (live, detailed)
last Past login history Past (log)

who and w read live session data (/run/utmp, which does not exist in some environments), while last reads an accumulated log (/var/log/wtmp). That's why only last can show people who have already logged out.

2. How do I see who is logged in now?

Conclusion: Just type who to list each logged-in user's name, terminalAn interactive program that reads the commands you type and runs them., and login time.

Lina: Let's start with "who is here right now."
Linny-senpai: Right, just type who on its own. No arguments or options needed.
$ who
lina     tty1         2026-06-05 09:12
linny    pts/0        2026-06-05 10:03 (192.168.1.20)
Lina: Two people. What are tty1 and pts/0?
Linny-senpai: Those are the terminals they logged in on. A terminal — also called a console — is simply the window where input and output pass through.
Linny-senpai: tty1 is a console attached directly to the machine. pts/0 is a virtual terminal over the network, such as SSH. The (192.168.1.20) on the right is the source IP, shown for remote logins.

Columns (left to right)

  • Username
  • Terminal (tty = physical, pts = pseudo-terminal = remote connection)
  • Login date and time
  • Source host / IP (if any)
Lina: What if I just want to confirm "this session is me"?
Linny-senpai: Type who am i and you'll see only your own session line. Note the spaces — it's three separate words.
$ who am i
linny    pts/0        2026-06-05 10:03 (192.168.1.20)

Lina's Mistake: Confusing whoami with who am i

Lina: Senpai, I typed whoami and all I got was a name. No terminal, no time.
Linny-senpai: That's because you ran a different command. whoami — no spaces, one word — prints only your username.
Lina: Wait, it isn't part of the who family?
Linny-senpai: They look alike, but they are separate commands. who am i — with spaces, three words — pulls just your own line out of the who output.
Lina: So a space turns it into a completely different command...! I'll check before I type from now on.

who am i (with spaces, three words) and whoami (no spaces, one word) are different commands. whoami is not an option of who. They're easy to mix up, so watch out for it.

3. How do I see what each user is doing?

Conclusion: w adds to what who shows — for each user it displays the command they are running right now, plus the server's load average, all on one screen.

Lina: I want to know what's making it slow. Can I see what each person is actually doing?
Linny-senpai: That's exactly what w is for. The top line shows the overall server state, and each row below shows the command each user is running.
$ w
 10:15:32 up 2 days,  3:41,  2 users,  load average: 0.15, 0.10, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
lina     tty1     -                09:12    1:03m  0.20s  0.20s -bash
linny    pts/0    192.168.1.20     10:03    2.00s  0.10s  0.05s w
Lina: That top line is packed with information...
Linny-senpai: Left to right: the current time, uptime (up), how many users are logged in, and the load average.
Linny-senpai: A higher load average means busier. The three numbers are averages over the last 1, 5, and 15 minutes.

What load average means

Load average is a number for how much work is piled up, including work still waiting its turn. Treat it as a busyness gauge. Think of a checkout line: it is close to the number of people standing in it. Smaller means quieter.

Key columns in w

  • USER / TTY / FROM: who, which terminal, from where
  • LOGIN@: login time
  • IDLE: time since last activity (longer = more idle)
  • JCPU / PCPU: how much CPU time was used (safe to skip at first)
  • WHAT: the command running right now
Lina: So WHAT tells me I'm just sitting in -bash (a shell), and you're running w.
Linny-senpai: Exactly. You can guess who is putting load on the machine and with which task.
Linny-senpai: Drop the header with w -h when it gets in the way. Narrow to one user with w lina.
$ w -h lina
lina     tty1     -                09:12    1:03m  0.20s  0.20s -bash

4. How do I see past login history?

Conclusion: last shows past login history, newest first. It includes people who have already logged out, so you can trace who logged in, when, and from where.

Lina: What about looking at the past — like "who logged in last night" rather than "now"?
Linny-senpai: That's last. It lists login and logout records, newest first.
Linny-senpai: There can be a lot of them. Start by limiting the count with -n.
$ last -n 5
linny    pts/0        192.168.1.20     Fri Jun  5 10:03   still logged in
lina     tty1                          Fri Jun  5 09:12   still logged in
linny    pts/0        192.168.1.20     Thu Jun  4 18:40 - 19:55  (01:15)
lina     pts/1        192.168.1.31     Thu Jun  4 14:02 - 17:30  (03:28)
reboot   system boot  6.8.0-generic    Thu Jun  4 08:00   still running
Lina: Some lines say still logged in and others say - 19:55 (01:15).
Linny-senpai: Good catch. still logged in means "still online now."
Linny-senpai: 18:40 - 19:55 (01:15) means "logged in at 18:40, logged out at 19:55, for a duration of 1 hour 15 minutes." For past sessions you also get the logout time and duration.

last -n 5 shows only the 5 newest entries. last -5 does the same thing. History piles up, so narrowing the count first makes it much easier to read.

5. How do I check reboots or a specific user?

Conclusion: Use last reboot for reboot/boot history, and last username to filter to one user's logins.

Lina: There was a reboot line in that history. Can I see when the server rebooted?
Linny-senpai: Yes. last reboot lists just the boot times. Handy for tracking "when did it go down / come back up."
$ last reboot
reboot   system boot  6.8.0-generic    Thu Jun  4 08:00   still running
reboot   system boot  6.8.0-generic    Mon Jun  1 07:55 - Jun  4 07:58 (2+23:03)
Lina: And if I want just one person's history, say mine?
Linny-senpai: Add the username after last. last lina lists only lina's logins.
$ last lina
lina     tty1                          Fri Jun  5 09:12   still logged in
lina     pts/1        192.168.1.31     Thu Jun  4 14:02 - 17:30  (03:28)
lina     tty1                          Wed Jun  3 09:30 - 18:10  (08:40)

To inspect failed logins, use lastb (the btmp log), not last. lastb needs administrator privileges, so run sudo lastb. It helps you spot signs of intrusion, such as many failures from an unfamiliar IP.

6. Mini Exercises - Get Hands-On

Conclusion: Three tasks — the current head count, recent history, and reboot history — to make the "now vs past" split stick.

Linny-senpai: Reading alone doesn't make it stick. Try these three.

Exercise 1: Count Who Is Logged In Now

Task: Find out how many people are logged into this server right now.

Show Hint 1 (Direction)

Two commands show "now." Pick the one that puts the head count on its first line.

Show Hint 2 (Command name)

Use w. Its header line contains users. Counting the rows from who works too.

Show Answer 
$ w
 10:15:32 up 2 days,  3:41,  2 users,  load average: 0.15, 0.10, 0.05

The 2 users part is the head count.

Exercise 2: Show the 3 Most Recent Logins

Task: Display past login history, limited to the 3 newest records.

Show Hint 1 (Direction)

Use the command that shows the past. On its own it prints far too much, so add the option that limits the count.

Show Hint 2 (Command name)

Use last. Limit with -n COUNT. Writing last -3 does the same thing.

Show Answer 
$ last -n 3
linny    pts/0        192.168.1.20     Fri Jun  5 10:03   still logged in
lina     tty1                          Fri Jun  5 09:12   still logged in
linny    pts/0        192.168.1.20     Thu Jun  4 18:40 - 19:55  (01:15)

Exercise 3: Show the Server's Reboot History

Task: Display the history of when this server booted.

Show Hint 1 (Direction)

The history command can be narrowed by adding a word after it. Add the word that stands for booting.

Show Hint 2 (Command name)

Use last, followed by reboot.

Show Answer 
$ last reboot
reboot   system boot  6.8.0-generic    Thu Jun  4 08:00   still running
Lina: Done! "Who is here now is who and w, the past is last" — I think I can remember that.
Linny-senpai: That split is the heart of it. When in doubt, run w first. Head count, load, and activity all arrive on one screen.

7. Common pitfalls and fixes

Conclusion: Most trouble comes from three things: confusing whoami with who am i, misreading still logged in in last, and looking for failed logins with last.

Symptom Cause Fix
Only a username appears Using whoami Use who for a list, w for detail
who am i returns an error Wrong spacing Three words with spaces: who am i
last output is too long to read Showing the full history Limit with last -n 10
Failed logins don't show in last Looking at the success log (wtmp) See failures with sudo lastb (btmp)
Unsure what still logged in means Confused with the duration format It means "still online now"
last prints only "wtmp begins ..." The history file (/var/log/wtmp) is empty Common on WSL and in containers. Try a real server or VM

When in doubt, follow this order: who is here now → who, what they're doing / load → w, look back into the past → last.

Today's Three-Line Summary

  • who lists who is here now, and w adds their activity and the load. Start with these two to read the current state
  • last is the past. Narrow it with last -n 5, and use last reboot for boot history alone
  • whoami (one word) and who am i (three words) are different commands. For failed logins, use sudo lastb

Next Reading

Share this article

Next steps

Next article → Setting Up Aliases - How to Shorten Linux Commands Practice with quiz → Verify your understanding Practice with lesson → Run commands in the terminal