WHOWATCH(1)

📦 version 1.8.6, in arch rolling, debian bookworm, epel 10, epel 9, fedora 43, fedora 44, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 WHOWATCH — like, the manual page bestie 💖

okay so before we even start: this is WHOWATCH(1) from the General Commands Manual section, and it is genuinely one of the most fun little tools ever, no cap. let's get into it 🦋

🌸 NAME 🌸

whowatch — a console, interactive, process and users monitoring tool. yes. it watches the who. it's in the name bestie 💅

✨ DESCRIPTION ✨

okay so Whowatch is a console, interactive users-and-process monitoring tool, and here's the tea: it shows you info about the users who are currently logged on to the machine, and it does it in real-time. like, live. as it happens. iconic behavior honestly 👑

and it doesn't just give you the boring basics — besides the standard stuff (login name, tty, host, user's process), it also shows you the type of the connection, like telnet or ssh. yeah. it knows how you got in. 🙈

the display of the user's command line can be switched over to tty idle time instead. so you get to pick your vibe.

you can select a certain user and view their processes tree, and you can also pull up the tree of all system processes. and when you're looking at a tree, you can turn on an extra column that shows you the owner of each process. cute right?

and here's the spicy part: in process tree mode you can send SIGINT, SIGHUP, SIGTERM and SIGKILL signals to the selected process. killing processes is just as simple and fun as deleting lines on the screen. fr fr. 🔥

also important: Whowatch has no command line options and no configuration file. none. zero. everything happens in real time by you just pressing keys. keyboard girlies rise 💅

🎀 Users list mode 🎀

  • 'up' 'down' — cursor movement, obviously. move the little cursor around 💖
  • 'i' — toggle between the user command line and the idle time
  • 'c' — full command line on/off. turning the full command line off can save CPU time. it can also give you some additional information about the process executable 👀
  • 'enter' — view the selected user's processes tree
  • 't' — all system processes (the init tree) 🌳

🦋 Tree mode 🦋

  • 'up' 'down' — cursor movement again, same energy
  • 'enter' — go back to the users list
  • 'o' — show processes owners
  • 'c' — full command line on/off. same deal as before: disabling the full command line can save CPU time, and it can give you some additional information about the process executable
  • 'Ctrl-I' — send INT signal to the selected process
  • 'Ctrl-K' — send KILL signal to the selected process 💀
  • 'Ctrl-U' — send HUP signal to the selected process
  • 'Ctrl-T' — send TERM signal to the selected process

🌈 PLUGINS 🌈

okay this part is lowkey the coolest. Whowatch has the ability to load a plugin during program run. the plugin prints information inside the details window. so you can just... add stuff. while it's running. main character energy fr 🧚

why do plugins exist? flexibility, bestie. if you need some specific information about a process, a user, or the system, then a separate program could be written to obtain such information. that's the whole point. 🫶

and since there are three kinds of details window (process, user and system), a maximum of three plugins can be loaded. three. that's the cap. ⭐

Whowatch has a very simple API for writing plugins, so if you're feeling crafty, go off 💜

💜 FILES 💜

the program reads /var/log/wtmp and /var/run/utmp. under Linux, the program also reads files from the /proc directory. 🍓

⚠️ without read access to these files, whowatch functionality will be limited — or the program will not even start. so like, permissions check first, bestie. don't come crying to me. 😭

👑 SEE ALSO 👑

finger(1), ps(1), pstree(1), top(1), w(1), lsof(8), kill(1), killall(1)

all the cousins. the whole family. go read them too 💅

💀 BUGS 💀

so this one's a real thing: because of a lack of ut_pid in the utmp and wtmp structures on *BSD systems, the program tries to obtain the pid of a login shell by analyzing processes' controlling terminal and processes' names.

under some conditions this may lead to incorrect results — for example, there will be an incorrect processes tree associated with the user's session. so like, if the tree looks sus on BSD, that's why. not your fault, not my fault, it's the structs' fault 🙈

🎀 AUTHOR 🎀

and that's the whole page bestie!! this version is from the 27 Feb 2000 release of WHOWATCH(1) — yeah it's vintage, and yeah it still ate. periodt. 💅✨🦋💖

📦 where this page comes from