How to find innactive users?

cizzi · 04-13-2008, 10:10 AM

I'm looking for a way to find users who have no logged in the system for 90 days so I can delete or warn them afterwards. Is there a linux command that can do this for me or do I have to write some kind of bash script?

tiocsti · 04-13-2008, 12:11 PM

Quote:

Originally Posted by cizzi

I'm looking for a way to find users who have no logged in the system for 90 days so I can delete or warn them afterwards. Is there a linux command that can do this for me or do I have to write some kind of bash script?

lastlog -b 90

This will get users who never logged in as well, in addition to system users. The former problem can be solved with a grep -vi 'never logged in' though.

cizzi · 04-13-2008, 12:28 PM

Thanks, thats exactly what I needed!

archtoad6 · 04-20-2008, 09:14 AM

I just ran lastlog -b 90, & was a bit disappointed when the list was so filled w/ system/daemon user names that I couldn't easily find the one human that hadn't ever logged in.

I checked the man page & the format of /var/log/lastlog, but I don't see any way, even the possibility of any way, to easily filter on UID or other criteria.

I envision a too complicated script that has to parse the UID's from /etc/passwd in the middle of processing the output from lastlog. I think the approach I am imagining is wrong.

Does anyone know an eas[y|ier] way of doing this?

Tinkster · 04-20-2008, 07:20 PM

Code:

awk -F: '$3 < 500 {print $1}' /etc/passwd > list
last | grep -v -f list

< 500 is true on *my* machine, may be a < 1000 on yours?

Cheers,
Tink

archtoad6 · 04-21-2008, 06:20 AM

Nice. Not quite as simple as I was hoping for, it's 2 lines

; but way less Byzantine than the calling awk w/in awk than I was envisioning.

BTW, the last time I used grep -f, grep -Ff worked much faster. It was a long list & a recursive grep, & -F made a huge difference. This is not so large a problem; so, while there is a measurable difference, it is not noticeable:

Code:

$ awk -F: '$3 < 1000 {print $1}' /etc/passwd > users_list

$ time lastlog -b 90 | grep -vf users_list
Username         Port     From             Latest
onthego                                    **Never logged in**
avg                                        **Never logged in**

real    0m0.061s
user    0m0.052s
sys     0m0.004s

$ time lastlog -b 90 | grep -vFf users_list
Username         Port     From             Latest
onthego                                    **Never logged in**
avg                                        **Never logged in**

real    0m0.012s
user    0m0.004s
sys     0m0.004s

Thanks for the code, I did find a user I didn't notice except for the filtering.

filex · 05-26-2008, 10:24 AM

what is the different between last and lastlog?I did a test and found last & lastlog command have different result.

archtoad6 · 05-27-2008, 07:17 AM

Are you asking about differences more subtle than those described in the respective man pages?

filex · 05-27-2008, 11:24 AM

Said a username: test1 last login date is 1 Jan 2008.

The 'last' command do not show username: test1 but the 'lastlog' command show me test1 results.

archtoad6 · 05-28-2008, 06:25 AM

Did you bother to read the man pages, as I tried to politely suggest in my post #8?

In short, they are different commands, why do you expect them to be the same/behave the same way?
Or am I missing the point of your Q entirely?