Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)?
I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like more detail.
I wrote a little bash script that I keep on a crontab job to see who's accounts to disable for lack of logins. I'm sure there are better ways, but this was quick/easy.
In your case, you dont want to filter out anything like i am; so wouldn't a simple
(to show the last month) suffice? it results in the following which tells me no one has logged into a system account.