If we look at the output from lastlog, when it is used without any options, we can begin to understand the issue. From the command line, we execute the command as a standard user. There is no requirement to run it as the root account. The command is shown in the following example:
$ lastlog
The partial output is shown within the following screenshot:
We can see, even from this limited output, that we have a cluttered output due to the virtual noise being created by the accounts that have not logged in. It is possible to alleviate this to some degree using the lastlog options but it may not entirely resolve the issue. To demonstrate this, we can add an option to lastlog to show standard users only and filter out other system and services users. This may vary on your system but on the sample CentOS 6 host that I am using, the first user will be UID 500. On CentOS 7, standard users UID starts from 1000.
If we use the lastlog -u 500-5000 command, we will only print data for those users with a UID within this range. On the simple demonstration system, we have just three user accounts for which the output is acceptable. However, we can understand that we may still have some clutter due to these accounts that have not yet been used. This is shown in the following screenshot:
In addition to the superfluous data being printed from Never logged in accounts, we may only be interested in the Username and Latest fields. This is another reason to support the need to use AWK as our data filter. In this way, we can provide both horizontal and vertical data filtering, rows, and columns.