If you can use last and get a list of those that have been active for your desired period, then you can use something like:-

Code:

cut -f1 -d ":" /etc/passwd | grep -vf active-list

You have to be careful that the active list doesn't match multiple accounts, e.g. a user named bob in the active list might also match bobby and you won't see it in the output.

How are your users defined? Are there likely to be false-positives in this?

perhaps you also need to merge your active list with a list of service accounts, e.g. root or oracle or whatever. You need to be sure that your listed idle users are checked before you do anything too drastic with them.



I hope that this helps,
Robin