uptime, who, w in Linux: who is on the system and the load

Q: The server "feels slow" — where to start

uptime → if load ≫ core count, find the culprit: top/ps sorted by CPU, w to see who's active. Low CPU with high load points to disk/IO or network — check processes and iostat.

Q: last is empty or looks odd

Login logs rotate (wtmp/btmp); older entries are in wtmp.1. Check suspicious logins through journalctl (journalctl _COMM=sshd).

Q: Someone else is editing the config

w shows other sessions and their WHAT. For working together, use tmux or screen.

Overview

The first thing to check when logging into an unfamiliar server: how long it's been up, how loaded it is, and who else is on it.

bash

uptime         # 11:20:05 up 3 days, 2:11, 2 users, load average: 0.15, 0.10, 0.09
who            # who's logged in (terminal, login time, from where)
w              # who + what they're running right now (+ load in the header)
last           # login/reboot history (from /var/log/wtmp)

Options

3

/

uptime takes no arguments and needs none — the three load average numbers say nothing on their own, their meaning only appears when compared with nproc. last -f /var/log/btmp shows failed login attempts separately from wtmp — these are two different logs with different purposes.

Option	What it does	Example
`-n` N	last — show only the last N entries.	`last -n 20`
`-a`	who — detailed output, including run level and getty processes.	`who -a`
`-f` FILE	last — read from a different log file, e.g. failed logins from btmp.	`last -f /var/log/btmp`

Nothing found. Try a shorter query.

Recipes

2

Load average

uptime shows three numbers — the average length of the run queue over 1, 5, 15 minutes:

compare with the core count (nproc): load = core count means fully loaded, higher means a queue is building, lower means there's headroom;
the three numbers show a trend: 2.0 0.5 0.2 — there was a spike and it's subsiding; 0.2 0.5 2.0 — it's rising;
high load with low %CPU means waiting on disk/IO (processes in state D) — see processes.

bash

nproc          # how many cores (what to compare load against)

Who and from where

bash

who -a                 # detailed: run level, getty processes, time
w                      # USER TTY FROM LOGIN@ IDLE WHAT — who's doing what
last -n 20             # the last 20 logins
last reboot            # reboot history
last -f /var/log/btmp  # FAILED logins (btmp) — useful for security
whoami                 # who I'm running as (see users-groups)

Troubleshooting

3

The server "feels slow" — where to start

uptime → if load ≫ core count, find the culprit: top/ps sorted by CPU, w to see who's active. Low CPU with high load points to disk/IO or network — check processes and iostat.

`last` is empty or looks odd

Login logs rotate (wtmp/btmp); older entries are in wtmp.1. Check suspicious logins through journalctl (journalctl _COMM=sshd).

Someone else is editing the config

w shows other sessions and their WHAT. For working together, use tmux or screen.

uptime, who, w — who is on the system and the load

Cheat sheet

Overview

Options

Recipes

Load average

Who and from where

Troubleshooting

The server "feels slow" — where to start

`last` is empty or looks odd

Someone else is editing the config

See also