Before disconnecting an account, investigating remote access, or handing off a shared host, the active login list shows which terminals are open right now. The Linux session database records interactive logins separately from background services, so checking it prevents confusing a running process with an actual signed-in user.
The who and users commands read the current session database, usually /run/utmp or the platform's equivalent. who shows the terminal, login time, idle state, process ID, and remote host when those fields exist, while users gives only the login names and may repeat a name for multiple sessions.
The w command adds uptime, load averages, idle time, and the foreground command attached to each terminal. Empty output can be normal on containers, non-login shells, broken session accounting, or systems that do not write session records for the shell, so pair a blank result with process or authentication checks before concluding that nobody has access.
Related: How to check user login history in Linux
Related: How to force a user to log out in Linux
Tool: IP Geolocation Finder
$ who --users admin pts/0 2026-06-13 09:18 00:07 3142 (203.0.113.10) deploy pts/1 2026-06-13 09:22 00:01 3288 (198.51.100.44)
Each row is one interactive session recorded by the host. A blank result means no current login rows were found in the session database, not that no user-owned processes exist.
$ who am i admin pts/0 2026-06-13 09:18 (203.0.113.10)
If who am i prints nothing, the shell may not be attached to a login record. This is common in containers, non-login shells, and some automated terminals.
$ w 09:29:46 up 4 days, 2:17, 2 users, load average: 0.08, 0.06, 0.04 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT admin pts/0 203.0.113.10 09:18 7:32 0.04s 0.04s -bash deploy pts/1 198.51.100.44 09:22 1:11 0.03s 0.02s vim deploy.yml
The WHAT column can expose command names and arguments. Sanitize this output before sharing it outside the operations team.
$ users admin deploy
Repeated names indicate multiple sessions for the same account. Use who when the terminal, login time, or remote host matters.