The lslogins command provides detailed information about user accounts on a Linux system. It displays data about users, including last login times, account statuses, and group memberships. It pulls information from various system databases like /etc/passwd, and is commonly used by system administrators to monitor user accounts and activity. This article is an overview of the lslogin command.
Syntax
lslogins [options] [user] Options
lslogins supports various options to control output and filtering of user information:
-a, --acc-expiration
Display the account expiration date for each user. Requires root privileges to view all accounts.-c, --colon-separate
Format output with colon-separated fields, useful for scripting.-d, --dir-name
Display the home directory path for each user.-e, --export
Export information in a format that’s easy to parse, such as JSON.-G, --groups
List all group memberships for each user.-l, --last
Show the time of the last login for each user.-L, --failed-logins
Display the number of failed login attempts. This can help identify security issues related to account access.-m, --mtab
Use information from/etc/mtabto display the mounted filesystem for each user.-n, --no-header
Suppress the header row in output, often useful for piping output into scripts or commands that require cleaner data without extra formatting.-p, --pwd-last-change
Show the date of the last password change for each user.-R, --root
Specify an alternate root directory. Useful when querying a different environment or mounted directory.-s, --system-accs
Show only system accounts, excluding regular user accounts.-u, --user-accs
Show only user accounts, excluding system accounts.-V, --version
Display version information for thelsloginscommand.
Examples of lslogins command usage
1. Display last login times for all users:
$ lslogins --last
UID USER LAST-LOGIN
1000 john 2024-11-04 10:34
1001 jane 2024-11-05 09:21
1002 doe 2024-11-06 08:152. Show user account expiration dates:
$ lslogins --acc-expiration
UID USER ACCOUNT-EXPIRATION
1000 john 2024-12-01
1001 jane 2024-12-153. View all users with a colon-separated format:
$ lslogins --colon-separate
UID:USER:HOME:DIRECTORY:SHELL:LAST-LOGIN
1000:john:/home/john:/bin/bash:2024-11-04 10:34
1001:jane:/home/jane:/bin/zsh:2024-11-05 09:214. Display groups and last login time for a specific user:
$ lslogins -G -l jane
UID USER GROUPS LAST-LOGIN
1001 jane jane,sudo 2024-11-05 09:215. List only regular user accounts:
$ lslogins --user-accs
UID USER
1000 john
1001 jane
1002 doeDescription
lslogins offers a flexible and detailed way to analyze user account information on Linux. It is an essential tool for system administrators needing to monitor account status, login activity, and related security information.
