Is there a command to find out if anyone logged into a machine as one of the System IDs (bin, sshd, rpc, etc)?

I've tried last, faillog, ausearch and aureport (this has worked the best), but I'd like more detail.

  • 1
    What are you looking for that last didn't give you? – Michael Hampton Mar 14 '14 at 15:49

I wrote a little bash script that I keep on a crontab job to see who's accounts to disable for lack of logins. I'm sure there are better ways, but this was quick/easy.

grep users /etc/group | awk -F ":" '{print $4}' | sed 's/,/\
/g' > list
for fn in `cat list`; do lastlog -u $fn | grep Never; done
rm list
lastlog -b 30 | grep -iv Never | awk '{if (NR!=1) {print $1" last logged in on "$5" "$6" at "$7}}'

In your case, you dont want to filter out anything like i am; so wouldn't a simple

lastlog -b 30

(to show the last month) suffice? it results in the following which tells me no one has logged into a system account.

daemon                                     **Never logged in**
bin                                        **Never logged in**
sys                                        **Never logged in**

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.