Unix lastlog records are stored in this way
sub get_lastlog_info {
my $user = shift;
$user = getpwnam($user) if $user =~ /\D/;
return unless defined $user;
open L, "<", "/var/log/lastlog" or return;
seek L, 292 * $user, SEEK_SET;
return unless read(L, my($buf), 292) == 292;
my ($time, $tty, $host) = unpack "i a32 a256", $buf;
return ($time, $tty, $host);
}
To use:
if (my ($time, $tty, $host) = get_lastlog_info(shift)) {
print "$user on $tty from $host\n\tat ",
scalar(localtime $time), "\n";
} else {
print "$user never logged in\n";
}
% perl lastlog.pl hkang hkang on pts/18 from evrtwa1-ar10-4-61-239-206.evrtwa1.dsl-verizon.net at Sat Apr 19 15:45:56 2003
% perl lastlog.pl www www never logged in
Complete code in lastlog.pl