Summary: lastlog file format and how to view the contents -

From: Jianguo Sun (
Date: Sun Mar 30 1997 - 23:21:43 CST

My original question was:
> Does anyone know there are Win95 simulation software (free or comercial)
> available?
The answers are:
Marc S. Gibian <> wrote:
SoftWindows by Insignia, a recently announced release, though we are running the
prior release and it is SLOW.
Sunpc from Sun appears to work as well, but I am less sure.
My customer has needed to run DOS applications as well as some Windows 3.1 stuff
on their SPARCstations, due to lack of source code to them, and thus Win95 is
not an issue.

Andi Paton
email : wrote:
SUN SunPC 133-Mhz 5x86 coprocessor(SBus) + Software. This runs MS-DOS and
Windows (3.x and 95) applications. If you go for this option, I would
look at the amount of memory required, SunPC works best with 16Mb of
its own memory, so you might need to upgrade.
The list price approx 500 STERLING.
My question was:
>Could anybody tell me the format of /var/adm/lastlog for
>Solaris 2.x and how to view it?

The answers are:
Bob Woodward <>
View it with the 'last' command. As to format, I never really took the
time to worry about it so I can't help you, there. I just have a cron job
run around 3:00am that copies /dev/null over the top of it.

<> wrote:
I use the command (last | more) instead of lastlog but the information is
similar. I find last easier to read at a glance and good for quick
security or overall system activity checks. The first field is who is
logged on. You will notice it may switch to root then back to a user.
 That means that user using su or changing permissions to root. To be
sure it is the same person watch the second field which will show where
the person is comming from. The console or a terminal. If it is from a
terminal it will give the terminal number. The third field gives a
location they are connectiong from. It will try to resolve a machine
name if it occurred over a terminal or show :0 for console. Then it will
show the date, the time they logged in and how long they were logged in
for. Or if they are still logged in. Hope this helps.

Sophia <>
It is a non-ascii file and you can view it with the command :
strings /var/adm/lastlog | more
the |more is if this file is big

Richard Skelton | e-mail : wrote:
The command is /usr/lib/acct/lastlogin
Try man lastlogin

 <> wrote:
        Look into /usr/include/lastlog.h. The structure of the records is
defined in there. The lastlog file is a random file, where the key is the
uid. If a user never logged in, then its record contains all zeros - binary
zeros - (so to speak though not technically corret). HTH. Regards ...

<> Check /usr/include/lastlog.h for the layout. The login
program prints the time of last login and updates it. The
file is a series of "struct lastlog" objects, indexed by user id.

Thanks for all your help.


This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:11:49 CDT