3.4.6. Displaying Comprehensive User Information

When administering users and groups on your system, you need a good tool to monitor their configuration and activity on the system. Red Hat Enterprise Linux 6 provides you with the lslogins command-line utility, which gives you a comprehensive overview of users and groups, not only regarding user or group account configuration but also their activity on the system.
The general syntax of lslogins is the following:
lslogins [OPTIONS]
where OPTIONS can be one or more available options and their related parameters. See the lslogins(1) manual page or the output of the lslogins --help command for the complete list of available options and their usage.
The lslogins utility gives versatile information in a variety of formats based on the chosen options. The following examples introduce the most basic as well as some of the most useful combinations.
Running the lslogins command without any options shows default information about all system and user accounts on the system. Specifically, their UID, user name, and GECOS information, as well as information about the user's last login to the system, and whether their password is locked or login by password disabled.

Example 3.13. Displaying basic information about all accounts on the system

~]# lslogins
  UID USER          PWD-LOCK PWD-DENY  LAST-LOGIN GECOS
    0 root                 0        0             root
    1 bin                  0        1             bin
    2 daemon               0        1             daemon
    3 adm                  0        1             adm
    4 lp                   0        1             lp
    5 sync                 0        1             sync
    6 shutdown             0        1 Jul21/16:20 shutdown
    7 halt                 0        1             halt
    8 mail                 0        1             mail
   10 uucp                 0        1             uucp
   11 operator             0        1             operator
   12 games                0        1             games
   13 gopher               0        1             gopher
   14 ftp                  0        1             FTP User
   29 rpcuser              0        1             RPC Service User
   32 rpc                  0        1             Rpcbind Daemon
   38 ntp                  0        1             
   42 gdm                  0        1             
   48 apache               0        1             Apache
   68 haldaemon            0        1             HAL daemon
   69 vcsa                 0        1             virtual console memory owner
   72 tcpdump              0        1             
   74 sshd                 0        1             Privilege-separated SSH
   81 dbus                 0        1             System message bus
   89 postfix              0        1             
   99 nobody               0        1             Nobody
  113 usbmuxd              0        1             usbmuxd user
  170 avahi-autoipd        0        1             Avahi IPv4LL Stack
  173 abrt                 0        1             
  497 pulse                0        1             PulseAudio System Daemon
  498 saslauth             0        1             Saslauthd user
  499 rtkit                0        1             RealtimeKit
  500 jsmith               0        0    10:56:12 John Smith
  501 jdoe                 0        0    12:13:53 John Doe
  502 esmith               0        0    12:59:05 Emily Smith
  503 jeyre                0        0    12:22:14 Jane Eyre
65534 nfsnobody            0        1             Anonymous NFS User
To display detailed information about a single user, run the lslogins LOGIN command, where LOGIN is either a UID or a user name. The following example displays detailed information about John Doe's account and his activity on the system:

Example 3.14. Displaying detailed information about a single account

~]# lslogins jdoe
Username:                           jdoe                                
UID:                                501                                 
Gecos field:                        John Doe                            
Home directory:                     /home/jdoe                          
Shell:                              /bin/bash                           
No login:                           no                                  
Password is locked:                 no                                  
Password no required:               no                                  
Login by password disabled:         no                                  
Primary group:                      jdoe                                
GID:                                501                                 
Supplementary groups:               users                               
Supplementary group IDs:            100                                 
Last login:                         12:13:53                            
Last terminal:                      pts/3                               
Last hostname:                      192.168.100.1                       
Hushed:                             no                                  
Password expiration warn interval:  7                                   
Password changed:                   Aug01/02:00                            
Maximal change time:                99999                               
Password expiration:                Sep01/02:00                         
Selinux context:                    unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
If you use the --logins=LOGIN option, you can display information about a group of accounts that are specified as a list of UIDs or user names. Specifying the --output=COLUMNS option, where COLUMNS is a list of available output parameters, you can customize the output of the lslogins command. For example, the following command shows login activity of the users root, jsmith, jdoe, and esmith:

Example 3.15. Displaying specific information about a group of users

~]# lslogins --logins=0,500,jdoe,esmith \
> --output=UID,USER,LAST-LOGIN,LAST-TTY,FAILED-LOGIN,FAILED-TTY
UID USER   LAST-LOGIN LAST-TTY FAILED-LOGIN FAILED-TTY
  0 root                                    
500 jsmith   10:56:12 pts/2                 
501 jdoe     12:13:53 pts/3                 
502 esmith   15:46:16 pts/3    15:46:09     ssh:notty
The lslogins utility also distinguishes between system and user accounts. To address system accounts in your query, use the --system-accs option. To address user accounts, use the --user-accs. For example, the following command displays information about supplementary groups and password expirations for all user accounts:

Example 3.16. Displaying information about supplementary groups and password expiration for all user accounts

~]# lslogins --user-accs --supp-groups --acc-expiration
  UID USER        GID GROUP     SUPP-GIDS SUPP-GROUPS PWD-WARN PWD-MIN PWD-MAX PWD-CHANGE
PWD-EXPIR
    0 root          0 root                                   7           99999 Jul21/02:00
  500 jsmith      500 jsmith    1000,100  staff,users        7           99999 Jul21/02:00
  501 jdoe        501 jdoe      100       users              7           99999 Aug01/02:00
Sep01/02:00
  502 esmith      502 esmith    100       users              7           99999 Aug01/02:00
  503 jeyre       503 jeyre     1000,100  staff,users        7           99999 Jul28/02:00
Sep01/02:00
65534 nfsnobody 65534 nfsnobody                                                Jul21/02:00
The ability to format the output of lslogins commands according to the user's needs makes lslogins an ideal tool to use in scripts and for automatic processing. For example, the following command returns a single string that represents the time and date of the last login. This string can be passed as input to another utility for further processing.

Example 3.17. Displaying a single piece of information without the heading

~]# lslogins --logins=jsmith --output=LAST-LOGIN --time-format=iso | tail -1
2014-08-06T10:56:12+0200