Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)?

I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like more detail.

share|improve this question
What are you looking for that last didn't give you? – Michael Hampton Mar 14 '14 at 15:49

I wrote a little bash script that I keep on a crontab job to see who's accounts to disable for lack of logins. I'm sure there are better ways, but this was quick/easy.

grep users /etc/group | awk -F ":" '{print $4}' | sed 's/,/\
/g' > list
for fn in `cat list`; do lastlog -u $fn | grep Never; done
rm list
lastlog -b 30 | grep -iv Never | awk '{if (NR!=1) {print $1" last logged in on "$5" "$6" at "$7}}'

In your case, you dont want to filter out anything like i am; so wouldn't a simple

lastlog -b 30

(to show the last month) suffice? it results in the following which tells me no one has logged into a system account.

daemon                                     **Never logged in**
bin                                        **Never logged in**
sys                                        **Never logged in**
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.