w
Show who is logged on and what they are doing.
Description
Reads the system utmp database to enumerate logged-in user sessions, then
correlates each session against /proc to report login time, idle time,
cumulative CPU time on the session’s tty (JCPU), CPU time of the
foreground process (PCPU), and the command that process is running.
The header line matches uptime(1): current wall-clock time, system
uptime, number of logged-in users, and the 1/5/15-minute load averages.
Inputs
/var/run/utmp– one record per login session. Each entry’s struct layout follows the system libc’sutmpx; entry stride is detected viastd::mem::size_of::<libc::utmpx>()to stay correct across glibc architectures (384 bytes on x86_64, 400 bytes on aarch64)./proc/[pid]/stat–tty_nr(controlling terminal device),tpgid(foreground process group),utime + stime(cumulative CPU ticks),comm./proc/[pid]/cmdline– shown in the WHAT column when non-empty./proc/uptime,/proc/loadavg– header line./dev/<tty>–st_rdev(matched againsttty_nrfor session membership) andatime/mtime(used to derive idle time).
The session source is utmp only. Modern procps-ng builds compiled with
systemd support read sessions from systemd-logind instead, which can
yield a different session list on systemd hosts. Logind support is a
planned follow-up.
Arguments
| Flag | Description |
|---|---|
[USER] | Show information for the named user only |
-h, --no-header | Don’t print the header line |
-u, --no-current | Don’t try to identify the foreground process; report info for the utmp entry’s own pid |
-s, --short | Short format – omit LOGIN@, JCPU, PCPU |
-f, --from | Show the FROM (remote host or display) column |
-i, --ip-addr | In FROM, show an IP address rather than hostname (best-effort DNS resolution) |
-p, --pids | In WHAT, prefix the command with loginpid/whatpid |
-o, --old-style | Blank IDLE for sessions idle less than one minute |
Behavior
Header line
HH:MM:SS up <uptime>, N user[s], load average: A, B, C
<uptime> is D days, H:MM, H:MM, or M min depending on magnitude.
Columns
Default layout (no -f, no -s):
USER TTY LOGIN@ IDLE JCPU PCPU WHAT
| Column | Source / meaning |
|---|---|
| USER | utmp ut_user (truncated to PROCPS_USERLEN, default 8) |
| TTY | utmp ut_line (basename of the controlling tty, e.g. tty2, pts/0) |
| FROM | utmp ut_host (only with -f; truncated to PROCPS_FROMLEN, default 16) |
| LOGIN@ | utmp ut_tv formatted by age (see below) |
| IDLE | now – max(atime, mtime) of /dev/<tty>; ? when the tty cannot be statted |
| JCPU | sum of utime + stime over all processes with the same tty_nr as the session’s tty |
| PCPU | utime + stime of the foreground process group leader on the tty |
| WHAT | cmdline of the foreground process; falls back to comm, then to - |
When the session has no resolvable tty (empty ut_line or no matching
device), JCPU/PCPU/WHAT fall back to the utmp entry’s own ut_pid.
LOGIN@ format
| Age | Format | Example |
|---|---|---|
| Same calendar day | HH:MM | 14:32 |
| Within 7 days | WeekdayHH (3-letter weekday + 2-digit hour) | Sat01 |
| Older | DDMmmYY | 25Apr26 |
Idle / CPU-time format
The IDLE column and the JCPU/PCPU columns share the same duration format:
| Magnitude | Format | Example |
|---|---|---|
< 60s | S.SSs (seconds with two decimals) | 0.06s |
< 60min | MM:SS | 54:42 |
< 24h | H:MMm (hours:minutes with m suffix) | 1:31m |
>= 24h | Ndays | 3days |
Environment
| Variable | Default | Effect |
|---|---|---|
PROCPS_USERLEN | 8 | Width of the USER column |
PROCPS_FROMLEN | 16 | Width of the FROM column |
Exit codes
| Code | Meaning |
|---|---|
| 0 | Success |
| 1 | Failure (cannot read /var/run/utmp) |