lsuser (username | ALL) discrepency

[bambock]

Can someone explain why there is a difference in the lsuser output below?

Using ALL:
[tt]lsuser -a id gecos account_locked time_last_login ALL | grep fred[/tt]

output:
[tt]fred id=2200 gecos=Fred Michaels account_locked=false[/tt]

Using Username:
[tt]lsuser -a id gecos account_locked time_last_login fred[/tt]

output:
[tt]fred id=2200 gecos=Fred Michaels account_locked=false time_last_login=1246541814[/tt]

It seems like very unusual behavior, and I can't put my finger on it. Additionally, this behavior isn't consistent with all users.

Thanks,
Ethan

 

[tempest92]

i would say fred had never logged on when you ran lsuser with ALL and then logged on before you ran lsuser with just fred. what happens if you run -

lsuser -a id gecos account_locked time_last_login fred

then

lsuser -a id gecos account_locked time_last_login ALL | grep fred

 

[bambock]

Thanks Tempest. With your suggestions I get the same results as posted in the output above.

I also forgot to mention that this user is logged in everyday they are working since they are support staff on the system. We run lsuser against all users, on weekly basis to audit for inactive users accounts. Also, I can run these commands one right after another, so the behavior is that same and not a matter of a time between report and login.

If I select another user, I get these results.

Using ALL:
[tt]lsuser -a id gecos account_locked time_last_login ALL | grep dave[/tt]

output:
[tt]dave id=2203 gecos=Dave Smith account_locked=false time_last_login=1246541814[/tt]


Using Username:
[tt]lsuser -a id gecos account_locked time_last_login dave[/tt]

output:
[tt]dave id=2203 gecos=Dave Smith account_locked=false time_last_login=1246541814[/tt]

Ethan