w Command in Linux

Introduction

Linux is a multi-user operating system and it can have several users logged in at the same time. Every user may access different files/directories and may perform different operations. It is not an easy task for system administrators to keep track of how many users are currently logged in.

In this tutorial, we will learn about w command in Linux to check the information of users who are currently on the system.

The w command is a Linux utility that enables the system administrators to view currently logged-in users and their ongoing processes. The command line output includes the usernames of the current users, their log-in location, and the operations they are performing.

The JCPU and PCPU columns can give a hint about the amount of computational work a user's processes are performing, which may be useful when diagnosing load issues.

The syntax of the w command is:

w [options] [username]

[options]: These are optional parameters that can be provided to modify the behavior or output of the command.
[username]: If you specify a username, w will only display information for that particular user.

The w command does not display past background jobs but shows presently running background jobs.

Note: w command does not show a history of past jobs or commands, whether they were run in the foreground or the background. When a user starts a background job in their terminal, if you run w at that exact moment, you might see that command in the WHAT column for that user because it's their current active process.

Breaking Down the Output

Here is an output of the w command-line utility without any option:

03:10:28 up 4 days,  4:21,  3 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    192.168.1.10      01:29   44:43   0.24s  0.24s -bash
tom      pts/1    192.168.1.22      02:26   42:32   0.06s  0.06s -bash
linuxops pts/2   92.168.1.22      02:22    0.00s  0.13s  0.01s w

When you use the w command without any options, the command header shows the current time, total system running time, number of users currently logged in, and average system load for the past 1, 5, and 15 minutes. The same information you can get from the uptime command.

After the headers line it shows the following 8 columns:

USER - The name of the user who logged in.
TTY - The terminal name which the user used to logged in.
FROM - The IP address or system hostname the user used to logged in.
LOGIN@ - The time when the user logged in
IDLE - This represents idle time. This show how long since the user typed any input on the terminal.
JCPU - The time used by all processes attached to the tty.
PCPU - The time used by the current process, named in the "what" field.
WHAT - The name of the user's current process.

The following figure describes w command header row fields and user information fields:

Options

Here are the primary options you can use with the w command:

-h or --no-header: Suppresses the header in the output. This means columns names like "USER", "TTY", etc., will not be displayed.
-u: Ignores the username while determining the current process and idle time. Without this option, w will show the process and idle times for the user running the command. With -u, w will show the times for the actual owner of the TTY.
-s or --short: Produces a shorter output format. Some columns like the JCPU, PCPU, and WHAT columns will be removed.
-f or --from: Toggles the FROM (remote host) field in the output. By default, this field is displayed. Using -f hides this column.
-o or --old-style: Produces an old-style output format, which can be slightly different from the default. This might be useful for those familiar with older versions of the w command or when parsing with certain scripts expecting the old format.
-i or --ip-addr: Display the IP address in the FROM field instead of the hostname (depends on version and distribution, as some versions may not support this).

Using w Command in Linux

When you use options with the w command, the output changes. The following examples show you how to use the w command to display information about all currently logged-in users and the operations that they are performing.

Display without Header

Use the w command with -h option to display output without header. This lets you focus only on the user information while avoiding system details and field labels:

w -h

Output
root     pts/0    192.168.1.10      01:29   58:14   0.24s  0.24s -bash
tom      pts/1    192.168.1.22      02:26   56:03   0.06s  0.06s -bash
linuxops pts/2    !92.168.1.22      02:22    3.00s  0.13s  0.00s w -h

This output does not show any header information, only the result entries.

Ignore Username

Use the -u option to ignore the username while figuring out the current process and CPU times:

w -u

Output
 03:26:57 up 4 days,  4:37,  3 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    192.168.1.10      01:29    1:01m  0.24s  0.24s -bash
tom      pts/1    192.168.1.22      02:26   59:01   0.06s  0.06s -bash
linuxops pts/2   192.168.1.22      02:22    1.00s  0.14s  0.00s w -u

To verify you can switch user using su and check the results of w and w -u.

Display IP Address

By default, the w command FROM field displays the hostname or the terminal of the remote user logged in the system. Use the -i option to display the IP address of the user:

w -i

This option displays the IP address of the user if the user is remotely connected. Otherwise, you will see only 0 in the FROM field.

Display Old-Style Output

You can use the w command with -o option to display old-style output in which the command prints blank space for the IDLE, JCPU, and PCPU fields if a user has been idle for less than one minute:

w -o

Output
 03:35:59 up 4 days,  4:46,  3 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    192.168.1.10      01:29    1:10                -bash
tom      pts/1    192.168.1.22      02:26    1:08                -bash
linuxops pts/2    192.168.1.22      02:22                        w -o

Toggle Printing FROM Field

The default output of the w command may not include the FROM field in some Linux distributions. For example, Arch Linux does not show the FROM field by default, but Ubuntu does. The -f option hides or shows the FROM field based on the default output of your system:

w -f

Output
 04:01:49 up 4 days,  5:12,  3 users,  load average: 0.00, 0.01, 0.00
USER     TTY        LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0     01:29    1:36m  0.24s  0.24s -bash
tom      pts/1     02:26    1:33m  0.06s  0.06s -bash
linuxops pts/2     02:22    5.00s  0.20s  0.00s w -f

This output is from Ubuntu where FROM field is displayed by default and the -f option hides it.

Display Specified User Information

To display information about a particular user, include the username as the w command argument. For example, if you want to display login time and other information for the user linuxopsys, type:

w linuxopsys

Output
 03:37:19 up 4 days,  4:48,  3 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
linuxops pts/2    192.168.1.22      02:22    5.00s  0.19s  0.01s w linuxopsys

Difference between W and Who Command

Linux provides various commands to display a list of the currently logged in users. The w and who are two such commands. However, these commands have some functional differences:

The w command shows user-level information like a list of currently logged-in users, the user ids, and the activities these users are performing on the system. It also displays system load averages and the running time. Whereas the who command determines the last time your system was booted, list of currently logged-in users, and current run level of the system. This command always displays the username of the user that is running the command.

w Command in Linux – Examples + Options

Introduction