sonar-users

Retrieves the list of accounts registered in Logpresso Sonar. There are no options; running it returns all registered accounts.

Command properties

Property	Description
Command type	Driver query
Required permission	Administrator
License usage	Counted
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

sonar-users

Output fields

Field	Type	Description
`guid`	string	A 36-character unique identifier
`login`	string	The account name used for authentication
`name`	string	The account user's full name
`title`	string	The account user's job title or position
`dept`	string	The department the account user belongs to
`phone`	string	The account user's landline phone number
`mobile`	string	The account user's mobile phone number
`email`	string	The account user's email address
`locale`	string	The account user's default language setting (`en` or `ko`)
`role_id`	integer	The account's role ID (0: guest, 1: cluster administrator, 2: company administrator, 3: user)
`role_name`	string	The account's role name
`home_menu_id`	integer	The default menu ID to display after login
`granted_tables`	array	The list of table permissions the account can access
`user_granted_profiles`	array	The list of connection profile usage permissions granted to the account
`group_granted_profiles`	array	The list of connection profile usage permissions granted to the groups the account belongs to
`user_group_guids`	array	The list of GUIDs of the groups the account belongs to
`trust_hosts`	array	The list of IP addresses allowed to log in to the account (access control list)
`idle_behavior`	string	The protective action for an idle session (`lock`: lock the screen, `logout`: automatic logout)
`idle_timeout`	integer	The time threshold (in seconds) used to determine an idle session (0 means unlimited)
`password_expiration`	integer	The password change requirement period (-1: system default, 0: unlimited, 7-3650 days)
`last_pw_change`	timestamp	The date and time of the account's last password change
`login_lock_count`	integer	The maximum number of consecutive failed login attempts before the account is locked (0-5)
`login_lock_interval`	integer	The time it takes for the account to unlock automatically after being locked (1-100000000 minutes)
`login_lock_until`	timestamp	The time when the account lock is scheduled to be released. `null` if the release time has already passed
`login_fail_count`	integer	The number of consecutive login failures. 0 if the lock release time has already passed
`last_login`	timestamp	The account's last login time
`auth_mode`	integer	The selected authentication method (0: internal/external authentication, 1: external authentication only)
`has_api_key`	boolean	Whether an API key has been issued for the account. Does not include the API key value itself
`preferences`	map	The account's personalized preference settings
`otp_enabled`	boolean	Whether OTP authentication is enforced when logging in to the account
`otp_registered`	boolean	Whether the user has registered an OTP device to the account
`created`	timestamp	The time the user account was created
`updated`	timestamp	The time the user account was last modified

Error codes

Parsing errors

Error code	Message	Description
300165	No permission to enumerate users.	Run in a session without administrator permission

Runtime errors

N/A

Description

sonar-users is an administrator-only command that retrieves every account registered in Logpresso Sonar. Running it in a session without administrator permission causes an error at the parsing stage and the query does not run.

The output fields include a number of attributes directly tied to account security, such as granted_tables (table permissions), trust_hosts (access control list), login lock/failure status, and OTP registration status. However, output is restricted to the same fields exposed by the REST API, so the password hash and the API key value itself are not included; the has_api_key field only lets you check whether an API key has been issued. Because of this nature, be careful not to leak account security attributes when sharing query results with other users or exposing them on a dashboard.

If the unlock time recorded in login_lock_until has already passed, the account is treated as if it were actually unlocked, so login_lock_until is returned as null and login_fail_count is returned as 0.

Examples

Query all registered accounts
```
sonar-users
```

Filter only accounts with an administrator role

sonar-users
| search role_id == 1 or role_id == 2
| fields login, name, role_name, dept, email

Check accounts that are locked or have not registered OTP

sonar-users
| search login_lock_until not null or (otp_enabled == true and otp_registered == false)
| fields login, name, login_lock_until, login_fail_count, otp_enabled, otp_registered

Aggregate the number of accounts by role

sonar-users
| stats count by role_name
| sort -count

Change history

The sonar-users command is available in the Sonar 4.0 series starting with 4.0.2609.0, where the command previously provided by the Experimental app was built into Sonar core. On versions without the built-in command, install the Experimental app to use it.