System insights with command-line tools: lslogins and lsmod

·3 min·Andreas Haerter·

Note: This article was originally released in the Fedora Magazine.

Continuing our exploration of commands that provide insights into the inner workings of your Linux system, we turn our focus to more simple ones like lslogins and lsmod. These tools offer information about user accounts and kernel modules, respectively.

lslogins: Look into User Accounts

lslogins is a command that extracts and displays detailed information about user accounts on your system. It pulls data from /etc/passwd and /etc/shadow files, along with system logs, to give you a comprehensive overview. It is especially useful to look for login failures and to list group memberships.

Basic Usage

Run the command without arguments to display a summary of all user accounts:

lslogins

This provides an overview including UID (User ID), GID (Group ID), user name, and last login details.

Common options and usage example

  • -u: Display only user accounts and root (filtering out system accounts with UIDs below 1000).
  • -G: Display information about exiting groups.
  • -g <group>: Show users of a specific group (e.g. wheel which usually has sudo-permissions on a Red Hat system).
  • -e: Display in an export-able key-value output format, separated by space.
  • -L: List last logins and password information (empty, logged, nologin).

Examples, listing the last logins and password information (empty, logged, nologin) of non-system user accounts on my laptop as well as group memberships:

$ lslogins -L -p -u
 UID USER      LAST-TTY LAST-HOSTNAME LAST-LOGIN PWD-EMPTY PWD-LOCK PWD-DENY NOLOGIN HUSHED PWD-METHOD
   0 root                                                                          0
1000 ahaerter  tty2     tty2               01:16                                   0      0

$ lslogins -G -u
 UID USER       GID GROUP     SUPP-GIDS  SUPP-GROUPS
   0 root         0 root
1000 ahaerter  1000 user      971,10,977 docker,wheel

lsmod: Listing Kernel modules for further inspection

The Linux kernel is fundamentally monolithic in design, but it also provides the capability to load and unload modules at runtime. A kernel module is generally understood as a component or an extension of the kernel. For example, hardware drivers (e.g., Wi-Fi cards, sound cards, etc.) are usually implemented as modules. The lsmod command provides a nice overview of all currently loaded kernel modules.

Basic usage

Simply type:

lsmod

This displays a table with three columns:

  1. Module: The name of the kernel module.
  2. Size: The memory size (in bytes) the module occupies.
  3. Used By: Lists the dependent modules or kernel features.

Example output:

$ lsmod
Module                  Size  Used by
overlay               241664  0
tun                    73728  2
snd_usb_audio         614400  0
snd_usbmidi_lib        57344  1 snd_usb_audio
snd_ump                49152  1 snd_usb_audio
snd_rawmidi            57344  2 snd_usbmidi_lib,snd_ump
hid_jabra              16384  0
uinput                 20480  0
rfcomm                102400  16
snd_seq_dummy          12288  0
snd_hrtimer            12288  1
wireguard             122880  0
curve25519_x86_64      36864  1 wireguard
libcurve25519_generic    45056  2 curve25519_x86_64,wireguard
ip6_udp_tunnel         16384  1 wireguard
udp_tunnel             36864  1 wireguard
nf_conntrack_netbios_ns    12288  1
nf_conntrack_broadcast    12288  1 nf_conntrack_netbios_ns
nft_fib_inet           12288  1
nft_fib_ipv4           12288  1 nft_fib_inet
nft_fib_ipv6           12288  1 nft_fib_inet
nft_fib                12288  3 nft_fib_ipv6,nft_fib_ipv4,nft_fib_inet
[...]

Usage examples

While lsmod doesn’t have options, pairing it with other commands enhances its utility:

  • Combine with modinfo: Get detailed information about a specific module, including its author, license, and description.
  • Debug with dmesg: Correlate kernel log messages with loaded modules to diagnose boot-time issues.
modinfo <module_name>
sudo dmesg | grep <module_name>

Conclusion

Commands like lslogins and lsmod can give you easy insights into user management and kernel behavior. Try them out today, and think about combining their output with other tools to appreciate their capabilities.