In article <email@example.com>,
> On Jun 3, 10:43 am, Dolphin <yc282...@yahoo.com.sg> wrote:
>> There is this file in /var/adm/lastlog. I would like to know how to
>> read it, any pointer is appreciated.
>> Thanks in advance.
> I think your better off using the 'last' command as it displays data
> in a more readable format. Examples include:
last(1) doesn't display /var/adm/lastlog at all.
The only command which does is finger(1).
Other than that, it's used by login, sshd, pam modules, and the like.
The file is a (sparse) array of struct lastlog (/usr/include/lastlog.h)
indexed by uid. Hence it can appear very big if you have large uids, but
it should be a sparse file (unless copied by anything which doesn't
preserve sparse files).
[email address is not usable -- followup in the newsgroup]