On an old GNU/Linux Ubuntu box I see something like

    $ w
 09:58:18 up 651 days, 19:30,  5 users,  load average: 0.28, 0.30, 0.24

The problem is, I am logged on other three sessions. The number should be four, not five. Any clue why the number of reported users is higher?

Checking lastlog, however, returns a correct value:

    $ sudo last -ain 7 | grep 'still logged in' | wc -l

[edited] Here is the output of who, taken in another occasion but still showing two users, and three reported by w

    $ who 
lorenzo  pts/0        Dec 28 13:10 (XXX)
lorenzo  pts/1        Dec 28 13:07 (XXX)
    $ w
 13:11:15 up 651 days, 22:43,  3 users,  load average: 0.49, 0.40, 0.31
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
lorenzo  pts/0    XXX              13:10    0.00s  0.11s  0.00s w
lorenzo  pts/1    XXX              13:07    3:09m  0.13s  0.13s -bash

My paranoid sense is tingling.

[edited] some more commands requested

    $ cat /etc/issue
Ubuntu 8.04 \n \l

    $ dpkg-query -S /usr/bin/w.procps 
procps: /usr/bin/w.procps

    $ dpkg-query -S /usr/bin/who
coreutils: /usr/bin/who
  • w command show you processes, which are running under your rights and on which terminal...
    – Jan Marek
    Dec 28, 2012 at 9:28
  • the first line I reported is shown also with uptime
    – lorenzog
    Dec 28, 2012 at 9:31
  • OK, it's not problem. But under the first line of w command you will see lines with processes, which is responsible for your 'logon'. In my case, there is processes startkde, kdeinit, bash and w.
    – Jan Marek
    Dec 28, 2012 at 9:36
  • In my opinion you should try using the who command it would become more clear.
    – dastergon
    Dec 28, 2012 at 10:40
  • I edited my original answer with the output from who
    – lorenzog
    Dec 28, 2012 at 12:16

3 Answers 3


w uses /var/run/utmp and the /proc filesystem (on Linux), recording who is currently logged on.

last uses /var/log/wtmp (and /var/log/btmp), showing how has been logging in. However, not every program will update those files properly, on some systems these files may not even exist.

For example, on my system w sees my 5 login-sessions within a single GNU screen session:

$ w | tail -n +3 | wc -l

$ last | grep -c still\ logged

Yet last only recorded one active session. When setting deflogin=off in GNU screen, even w loses track of the active login sessions and keeps displaying 5 sessions, even though I've just opened another 5 windows in that same screen session.

IOW: use e.g. ps to find out how many users are "online", how many shells are open, etc. It will give more accurate results as does not rely on (stale) statfiles like /var/log/utmp.


In my case, w returns the Xsession in plus the open terminals

$ w
 12:05:40 up  3:47,  2 users,  load average: 0.02, 0.15, 0.16
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
userXX   tty7     :0               08:18    3:47m 13:41   0.00s /bin/sh /etc/xdg/xfce4/xinitrc -- /etc/X11/xinit/xserverrc
userXX   pts/0    :0.0             12:03    0.00s  0.11s  0.00s w

It is why there is one user more. Do you have the same thing ? Could you give use the complete w result, if it is not the case ?

  • You haven't understood my question. In fact, your w command reports correctly two users, and you have two logged in (one for the X session one the open terminals). In my case, however, I am shown only N-1 users of the N reported in the first line.
    – lorenzog
    Dec 28, 2012 at 12:17

when using just 'w' it will display the header plus the command that you are currently launching, so it will always show an additional line where your user appears executing 'w', then it will always show one more line.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.