lsuser -a attribute ALL not working as expected?

[exsnafu]

this should be pretty simple.. I want a list of all users unsuccessful_login_count

I have a system that is an LDAP client, if I issue an lsuser -ca unsuccessful_login_count against both a local and LDAP authenticated user I can see the permissions.

[root@lab04:/etc/security]: lsuser -ca unsuccessful_login_count ldapacct
#name:unsuccessful_login_count
ldapacct:2
[root@lab04:/etc/security]: lsuser -ca unsuccessful_login_count localacct
#name:unsuccessful_login_count
localacct:3
[root@lab04:/etc/security]: lsuser -ca unsuccessful_login_count ALL
3004-697 Attribute "unsuccessful_login_count" is not valid.
[root@lab04:/etc/security]:

why is it not valid for all? if i do luser -c ALL, it works and some accounts do not have that attribute but if i list them individually they just return a 0, what i'd expect from using ALL, too.

am i missing something here?

 

[khalidaaa]

Try this:

lsuser ALL | grep -i "unsuccessful_login_count" |awk '{print $1}'

Regards,
Khalid

 

[khalidaaa]

From what i've noticed that unsuccessful_login_count is only shown if the user attempted unsuccessfully to login. It will stay there even if your reset the unsuccessful_login_count (it will have 0 as a value)!

Regards,
Khalid

 

[exsnafu]

khalidaaa, yes.. I can just dump all records for every user and parse out unsuccessful.. but i'd like to understand why it doesnt work if specified explicitly against ALL.. just kind of odd.

and true it doesnt show the attribute on users who've never logged an entry in lastlog for it but if you specify such a user it doesn't give you an error, it just reports 0.. so you'd expect the same behavior out of ALL.

i dunno, nitpicking maybe.