---
title: 'lfd:tracking:userid'
url: 'https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-tracking-userid'
markdown: 'https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-tracking-userid.md'
date: '2026-10-07'
description: 'Configure the tracking of UID blocks logged by iptables to syslog. juggernaut --task=lfd:tracking:userid Option Value Default Description --UID_INTERVAL <0|60-86400> 0 Enable user ID tracking. Track UID blocks logged by iptables to syslog. If a UID generates a port block that is l…'
taxonomy:
  category:
    - docs
  tag:
    - tracking
---

[](#)  [ Basics ](https://docs.danami.com/juggernaut/)     [ Command Line Interface ](https://docs.danami.com/juggernaut/command-line-interface)      Lfd       lfd:tracking:userid    

# lfd:tracking:userid

Configure the tracking of UID blocks logged by iptables to syslog.

```
juggernaut --task=lfd:tracking:userid
```

| Option | Value | Default | Description |
|---|---|---|---|
| `--UID_INTERVAL` | <0\|60-86400> | 0 | Enable user ID tracking. Track UID blocks logged by iptables to syslog. If a UID generates a port block that is logged more than UID\_LIMIT times within UID\_INTERVAL seconds, an alert will be sent. |
| `--UID_LIMIT` |  | 10 | The number of times within UID\_INTERVAL before an alert will be sent. |
| `--UID_PORTS` | <string> | 0:65535,ICMP | The port or port ranges that should be tracked by the User ID tracking feature. The default setting of 0:65535,ICMP covers all ports. |
| `--default` | <yes> |  | Reset all settings to their default values. |
| `--default_option` | <option> |  | Reset a specific setting to its default value. |
| `--restart` | <yes> |  | Restart the service after saving settings. |

## Examples

```
// set the UID_INTERVAL
juggernaut --task=lfd:tracking:userid --UID_INTERVAL=3600 --restart=yes

// reset UID_INTERVAL to default
juggernaut --task=lfd:tracking:userid --default_option=UID_INTERVAL --restart=yes

// reset all settings back to default
juggernaut --task=lfd:tracking:userid --default=yes --restart=yes

// alert when a user account generates 20 blocked outgoing connections within 10 minutes
juggernaut --task=lfd:tracking:userid --UID_INTERVAL=600 --UID_LIMIT=20 --restart=yes
```

## Related Pages

- [Process Tracking](https://docs.danami.com/juggernaut/user-guide/process-tracking "Process Tracking")
- [Login Tracking](https://docs.danami.com/juggernaut/user-guide/login-tracking "Login Tracking")
- [Tracking Settings](https://docs.danami.com/juggernaut/settings/login-failure-daemon/tracking-settings "Tracking Settings")

 [ ](https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-tracking-process) [](https://docs.danami.com/juggernaut/settings/login-failure-daemon/tracking-settings)

---

## Navigation

- Previous: [lfd:tracking:process](https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-tracking-process.md)