w.procps

w [options] [user]

-h, --no-header
    Do not print the header line that normally appears at the top of the output.

-u, --no-current
    Disables the updating of the current process and CPU times for each user. This can make the output slightly less verbose and faster to generate, useful for frequent execution in window manager environments.

-s, --short
    Uses the short format. Does not print login time, JCPU, or PCPU times, resulting in a more compact display.

-f, --from
    Toggles printing the 'from' (remote host) field. This field is typically shown by default, so this option explicitly enables/disables it.

-o, --old-style
    Prints blank space for idle times less than one minute. This behavior mimics older versions of the command.

-i, --ip-addr
    Display IP address instead of hostname for the 'from' field. This option is only effective if the 'from' field is enabled (e.g., with -f).

user
    Show information only for the specified user, filtering the output to display details exclusively for that user account.

The w command displays information about the users currently logged on to the system, along with their active processes. It provides a quick snapshot of system activity by showing for each user:
- The username
- The terminal (TTY) they are using
- Their login time
- Idle time
- JCPU (time consumed by all processes attached to the TTY)
- PCPU (time consumed by the current process)
- The command line of their current process.
This utility is a core component of the procps (or procps-ng) suite, which provides various essential tools for monitoring and managing processes on Linux systems. It is invaluable for system administrators to quickly assess who is on the system, what they are doing, and identify potential resource hogs or idle sessions.

The COMMAND column may be truncated if the command line is very long, showing only the initial part of the process.
The accuracy of the IDLE, JCPU, and PCPU times can vary, as they depend on the system's ability to precisely track process activity and may not always reflect exact real-time usage for very short-lived processes or rapid application switching.
The FROM field (remote host) might not always be accurately resolved or displayed, especially if DNS resolution is slow or if the connection originates from a non-standard source.
The command relies on information from system files like /var/run/utmp (or /var/log/wtmp for historical data) and the /proc filesystem. If these files are corrupted or inaccessible due to permissions, the output may be incomplete or erroneous.

w is frequently used to quickly:
- Identify who is logged into a multi-user system.
- Check if a specific user is active or idle.
- Detect unusual activity, such as unknown users or processes.
- Troubleshoot system performance by observing high CPU usage by a specific user's processes (PCPU/JCPU).

The w command has a long and venerable history, dating back to early Unix systems. It has been a staple utility for system monitoring and is traditionally included in the procps (now often procps-ng) package on Linux distributions. This package provides a set of essential command-line tools for interacting with the Linux kernel's process information available via the /proc pseudo-filesystem, evolving over time to incorporate new kernel features and user requirements.

who(1), uptime(1), users(1), ps(1), top(1)