The w command shows a bunch of information about who's logged in what they are doing.

Example from Wikipedia:

$ w
 11:12am up 608 day(s), 19:56,  6 users,  load average: 0.36, 0.36, 0.37
User     tty       login@  idle  what
smithj   pts/5      8:52am       w
jonesm   pts/23    20Apr06    28 -bash
harry    pts/18     9:01am     9 pine
peterb   pts/19    21Apr06       emacs -nw html/index.html
janetmcq pts/8     10:12am 3days -csh
singh    pts/12    16Apr06  5:29 /usr/bin/perl -w perl/test/program.pl

I know that it gets the first 3 columns' information from utmp and wtmp, which has read permissions for everyone, but where does it get the information for idle time and what the user is currently doing?

ls -l $(which w) shows that the w program does not have the setuid bit set and as a regular user, I have no permission to see other processes in /proc.

  • On which operating system? Linux? and if so, which distro? (Remember, we cover all Unix variants here, and the details differ depending on OS).
    – derobert
    Commented Sep 22, 2015 at 17:19
  • I'm on Solaris, but I'm actually interested in knowing the answer for all variants of UNIX. I use Linux as well and from what I can tell, the w command doesn't seem to vary too much between variants.
    – user193130
    Commented Sep 22, 2015 at 17:21

1 Answer 1


On linux at least, since any user input on the terminal will access the current user device it does a stat() call to /dev/{tty,pts/}?* and checks for atime for logged in users.

From w.c:

    /* stat the device file to get an idle time */
    static time_t idletime(const char *restrict const tty)
            struct stat sbuf;
            if (stat(tty, &sbuf) != 0)
                    return 0;
            return time(NULL) - sbuf.st_atime;

    static void showinfo(utmp_t * u, int formtype, int maxcmd, int from,
            print_time_ival7(idletime(tty), 0, stdout);

stat() only requires execute (x) permissions on parent directory to work.

  • Ah the tty device's modified time also seems to be updated on Solaris when I execute a command, so I think this is also how it's done on Solaris. What about the "what" column? Could you link to the source where you found w.c?
    – user193130
    Commented Sep 22, 2015 at 18:13
  • @user193130 The source is at procps.sf.net The "what" column is found in the getproc() function in the same file (w.c). The function scans the process table and searches for the "best" process to report as "(w)hat" based on the controlling terminal & start time of process (in linux from the /proc filesystem).
    – nkms
    Commented Sep 22, 2015 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .