w

Display information about all users who are currently logged in

$ w

$ w [username]

$ w [[-h|--no-header]]

$ w [[-s|--short]]

w [options] [user]
or
w [-h|--no-header] [-u|--no-current] [-s|--short] [-f|--from] [-o|--old-style] [-i|--ip-addr] [-V|--version] [-e|--extra-args] [-c|--no-args] [user]

-h, --no-header
    Do not print the header line that normally shows current time, uptime, number of users, and load averages.

-u, --no-current
    Ignores the username when figuring out the current process and CPU times. This can be useful if the user field is busy or contains unusual characters.

-s, --short
    Uses the short format, which omits the login time (LOGIN@), JCPU (Job CPU time), and PCPU (Process CPU time) columns.

-f, --from
    Toggles printing the 'from' (remote host) field. By default, this field is usually shown.

-o, --old-style
    Uses old-style output. This means it prints a blank in the idle column for idle times less than one minute, rather than '0s'.

-i, --ip-addr
    Displays IP addresses instead of hostnames for the 'from' field, which can be faster if DNS lookups are slow.

-V, --version
    Displays version information for the w command and exits.

-e, --extra-args
    Shows process arguments. This is typically the default behavior, but the option is provided for compatibility with older versions or specific configurations that might hide arguments by default.

-c, --no-args
    Hides the command line arguments of processes in the 'WHAT' column, showing only the command name.

user
    Displays information only for the specified username. If provided, the output will filter to show only sessions belonging to this user.

The w command displays information about the users currently logged on to the system and what they are doing. It provides a quick snapshot of system activity. For each user, it typically shows their login name, the terminal they are using (TTY), the remote host they logged in from (FROM), their login time (LOGIN@), their idle time (IDLE), the CPU time used by all processes attached to their TTY (JCPU), the CPU time used by their current process (PCPU), and the command line of their current process (WHAT). This command is valuable for system administrators to monitor user activity, identify idle sessions, or pinpoint processes consuming system resources. It is part of the procps suite.

• The CPU times (JCPU, PCPU) are cumulative and represent the time used by processes associated with the TTY or the current process, respectively. They are not real-time CPU usage and can be misleading for short-lived processes.
• The 'WHAT' field might truncate long command lines, showing only a portion of the actual command.
• The 'IDLE' time can be misleading for users running background processes or services that don't interact with the TTY, as they might appear idle but still be performing work.
• The information presented by w relies on the /proc filesystem and /var/run/utmp (or equivalent) for user session data. If these sources are corrupted or inaccessible, the output may be incomplete or incorrect.

The standard output of w includes several columns, each providing specific details:
USER: The login name of the user.
TTY: The terminal line the user is currently using.
FROM: The hostname or IP address from which the user logged in.
LOGIN@: The time when the user logged in to the system.
IDLE: The time duration since the user last typed anything on their terminal, indicating inactivity.
JCPU: JCPU (Job CPU time) is the cumulative CPU time used by all processes attached to the TTY, including background jobs.
PCPU: PCPU (Process CPU time) is the CPU time used by the user's current process, which is displayed in the 'WHAT' column.
WHAT: The command line of the current process the user is running.

The header line of the w command, which can be suppressed with -h, provides system-wide information:
Current time: The precise current time on the system.
Uptime: How long the system has been running since its last reboot.
Number of users: The total count of users currently logged in.
Load averages: The system load averages for the last 1, 5, and 15 minutes, indicating the average number of processes in the run queue or waiting for disk I/O.

The w command has been a staple utility in Unix-like operating systems for decades, originating in early BSD systems. It was designed to provide a more detailed view of logged-in users compared to simpler commands like who, specifically by showing what processes users were running. Over time, its implementation on Linux evolved to leverage information from the /proc filesystem, allowing it to display running processes and their CPU usage more effectively. It is now typically part of the procps or procps-ng suite, which manages utilities for interacting with the /proc filesystem. Its core functionality of showing 'who is logged on and what they are doing' has remained consistent, making it a quick and essential diagnostic tool for system administrators.

who(1), users(1), last(1), ps(1), uptime(1), top(1)