Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)?

I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like more detail.

share|improve this question
1  
What are you looking for that last didn't give you? –  Michael Hampton Mar 14 at 15:49
add comment

1 Answer 1

I wrote a little bash script that I keep on a crontab job to see who's accounts to disable for lack of logins. I'm sure there are better ways, but this was quick/easy.

#!/bin/bash
grep users /etc/group | awk -F ":" '{print $4}' | sed 's/,/\
/g' > list
for fn in `cat list`; do lastlog -u $fn | grep Never; done
rm list
echo
lastlog -b 30 | grep -iv Never | awk '{if (NR!=1) {print $1" last logged in on "$5" "$6" at "$7}}'

In your case, you dont want to filter out anything like i am; so wouldn't a simple

lastlog -b 30

(to show the last month) suffice? it results in the following which tells me no one has logged into a system account.

daemon                                     **Never logged in**
bin                                        **Never logged in**
sys                                        **Never logged in**
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.