The who command -continued

The options assosciated with the who command are as follows:

• -u:    This option lists only those users who are currently logged in .The name  is the user's login name. The line is the name of the line as found in the directory /dev. The  time is the time that the user logged in. The  idle column contains the number of hours and minute  since  activity last occurred on that particular line. A dot(.) indicates that the terminal has seen activity in the last minute and is therefore 'current'. I f more than 24 hours have lapsed or the line has not been used since boot time, the entry is marked old. This field is useful to find out whether a person is currently working at the terminal line or not. The pid is the process-ID of the user's shell. The  comment is the comment field assosciated with this line as found in  /sbin/inittab  file. This can contain information about where the terminal is located, the telephone number of the data set, type of terminal if hard-wired and so on.
• -T:     This option is same as the -s option except that the state  of the terminal line is printed.The state  describes whether  someone else can write to that terminal. A '+' appears if the terminal is writeable by anyone, else a '-' sign appears.  root  can write to all lines whether a '+' appears or a '-'.If a bad line is encountered a question mark(?) is printed.
• -l:       This option lists only those lines on which the system is waiting for someone  to login.The  name is LOGIN  in such cases. Other fields are same except that the  state  field does not exist.
• -H:     This option will print column headings above the  regular output.
• -q:      This is a 'quick who' listing only the names and numbers of the users currently logged in. When this option is used all other options are ignored.
• -p:      This option lists any process that is currently active and has previously been spawned by init. The  name is the name of the program executed by init   as found in /sbin/inittab file. The state,line  and idle  fields have no meaning .The  comment  field shows the  id  field from the   /sbin/inittab  file that generated this process.
• -d:       This option displays all processes that have expired and not been regenerated by init.The exit field appears for dead processes and  contains the termination and exit values, as returned by the wait command. This can be useful in determining why a process terminated.
• -b:        This option indicates the time and date of the last reboot.
• -r:         This option indicates the current run level of the init process.It also displays the process termination status ,process-ID and process exit status under the idle,pid and the comment  headings respectively.
• -t:          This option indicates the last change to the system clock via the date  commnad , by root. 
• -a:         This option processes /var/adm/utmp  file or the named file with all options turned on.
• -s:         This option is the default and lists only the  name, line and time fields respectively.
• -nx:       This optin takes a numeric argument, x , which specifies the number of users to display per line. x must be at least 1. The -n option must be used with -q.

After a shutdown to the single user state, who returns a prompt.The reason is that since /var/adm/utmp file is updated at login time and there is no login in single user state, who cannot report accurately on this state.  who am i  however returns the correct information.
The who command uses the files / var/adm/utmp, / var/adm/wtmp  and /sbin/inittab.

 The next post would be about tty command.