Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I need some info whether a service account:xyz which is not in use for a longer time. We want to disable the account which are not used but we do not know whether the account is being used /active by any application. I use lastlog command and find out the last loggedin users where this service account:xyz has recently logged into any system. Is there any other way to find out whether a user has recently logged in or not apart from lastlog ?
service users usually not logged in. The processes, which belong to those services will use them, but without logging in.
For example on my host the service mosquitto is started when I boot the host and the user mosquitto will be the owner of the process (which is in turn mosquitto again)
Ok, I understand the point that service accounts will not be logged in and instead the processes uses it but there would be no trace of user account tologin.
Now another query here: a user account to track their last logged in , Is lastlog only method ??which other ways the user can login and how to trace their login.
Please note the user account have been created long time ago , probably 2 years or more. Apart from the /var/log/secure or /var/log/messages , is there a way to track.
it depends on how did they log in (using ssh, or any other method). Usually these tools have logging capabilities, therefore you can check those log files, if available.
You can use the commands last, who, and probably others too. But there can be cases.... It depends on the host, the number of users and installed software
On my system sshd and su update the lastlog, but not sudo.
Some desktop logins update it.
The last command uses wtmp (a DB file) that should be updated whenever a terminal is involved, but some terminal tools refuse to update wtmp.
It's a mess.
/var/log/secure is updated if PAM is involved, so should work with su, sudo, sshd.
I think the only reliable method is to enable process accounting.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
service accounts last logged in.
