I need a list of users that I cannot find by using the last command (i.e. they were not logged in recently).

Would a temporary file be useful for this?


This gives you those who were seen from the 'last' command in a file called 'last.txt'.

last | cut -f1 -d' ' | uniq | sort | grep -v reboot | grep -v wtmp | egrep -v "^$" > last.txt

This gives you those all users on the system in a file called 'passwd.txt'.

cat /etc/passwd | cut -f1 -d: | uniq | sort > passwd.txt

Interpreted correctly this gives you the difference. Namely, "those who are not on the last command".

diff last.txt passwd.txt 

This is easier to look at though.

sdiff last.txt passwd.txt | less

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.