I need the equivalent command of linux lastlog in solaris, need to write a script to find the the users last login date and time in solaris servers. Linux its very easy to fetch using lastlog command.

I tried last -1 USERID , if any user not logged in that server then there is no ouptut , the task is to find the users who not logged in server more that 90 days, a script should give the output as

ServerName USERID 10-Jun-2018 3Days
  • This might help. unix.stackexchange.com/questions/97595/… – tk421 Jun 13 '18 at 17:29
  • 1
    am able to get the last logged in date using the following command finger $USER | sed -n 3p Last login Mon Apr 3, 2017 on pts/1 from abc_server – judi Jun 13 '18 at 18:12
  • am able to get the last logged in date using the following command finger $USER | sed -n 3p Below is the output from here am able to get the day,month and year which I can convert to epoch using perl and subtract from current date, Last login Mon Apr 3, 2017 on pts/1 from abc_server The new issue is, if any user logged in date is less than 6 months, then the year is not visible, how to get get the epoch for this date Last login Wed Dec 27 12:32 on pts/1 from abc_server – judi Jun 13 '18 at 18:19
  • Looking at the other post, it shows the user's login time using epoch time. You can try date +"%s" to get the current epoch time (in seconds) then subtract 90 days from that and filter with awk. – tk421 Jun 13 '18 at 19:33
  • Source for finger is here – Mark Plotnick Jun 13 '18 at 20:53

There is no direct equivalent to the Linux lastlog command, that is supplied with the operating system.

In the Linux login accounting system there is a table that records the last login time of each user account, indexed by that account's user ID. In the NetBSD, FreeBSD, and OpenBSD login accounting systems, there is an equivalent table (albeit with a different structure and name), and (in the NetBSD and FreeBSD systems) a lastlogin command that dates from the middle 1990s. In both the Linux and BSD worlds, this table is updated by the same programs that write the login log table and the currently active logins table, two other tables in the login database.

Solaris has two tables: an equivalent one, and one that is not quite equivalent.

The last command, that other people are pointing to, is not particularly useful because it does not operate from either one. It operates off a different table in the login accounting database, the log of login events table; and as you can see if an account has never logged in there will be nothing in that table to process. Whereas, in contrast, with the last login time table there is a record (on the BSDs an empty implicit one, on Linux an explicit empty one) for every user account.

The Solaris table that is not quite equivalent is /var/adm/acct/sum/loginlog. This is not directly populated by the login program as logins happen, and there is no directly equivalent program for reporting on it.

It is associated with a lastlogin command; however, that is quite different to the aforementioned command by that name. On Solaris, it is a tool for writing to this table rather than a tool for reporting upon its contents. (This is also what lastlogin is for on AIX.) The runacct tool, run daily, invokes the lastlogin command to populate this table. Reporting is done with the prtacct command.

The Solaris table that is directly equivalent is /var/adm/lastlog, which is not mentioned in Oracle doco. There is no program supplied for reading it. However, there was (until the software died at Oracle) a third party lastlog program written by Richard Hamilton available. You might like to convince the OpenIndiana/Illumos people to incorporate such a command. Dan McDonald, OmniOS engineer, was touching this stuff as recently as January 2016.

Further reading

  • Jonathan de Boyne Pollard (2018). The Unix login database. Frequently Given Answers.
  • "System Accounting Files". System Administration Guide: Advanced Administration. Oracle Solaris 10 8/11 Information Library. Oracle. 2011.
  • lastlog. Oracle Solaris Blog. 2010-07-15.
  • lastlogin. FreeBSD System Manager's Manual. 2011-06-06.
  • last. User Commands Manual. Illumos. 2017-04-12.
  • acctsh. System Administration Commands. SunOS 5.11. 2002-03-15.
  • 1
    Thank you, I wish there would be more answers like this one. Informative, thorough, with extra comparative notes. Kudos! – gsl Jun 15 '18 at 6:56

The command for that in Solaris is last.

This will show you the last time the user tim logged in.

bash-[510]$ last -1 tim
tim       pts/1    Wed Jun 13 18:16   still logged in

If that user hasn't logged in since the db has been rotated, you won't get any output.

bash-[511]$ last -1 tom

wtmp begins Fri Mar 27 19:57

Oracle Solaris also offers a nice tool called


You can find a description on the following link Sytem Accounting.

In the directory /var/adm/acct/sum you will find a file called loginlog. This file record the last date each user logged in and is created by the lastlogin script.

Based on this file and using e.g. awk it should be very simple to fullfill your requires.


I think the command you are searching for is the last command.


last, lastb - show a listing of last logged in users

SYNOPSIS last [options] [username...] [tty...] lastb [options] [username...] [tty...]

DESCRIPTION last searches back through the /var/log/wtmp file (or the file designated by the -f option) and displays a list of all users logged in (and out) since that file was created. One or more usernames and/or ttys can be given, in which case last will show only the entries matching those arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0.

When catching a SIGINT signal (generated by the interrupt key, usually control-C) or a SIGQUIT signal, last will show how far it has searched through the file; in the case of the SIGINT signal last will then terminate.

The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all the reboots since the log file was created. lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts.

Otherwise lastlog as you mentioned:

lastlog -b 90

In case you haven't installed lastlog, follow this link:

 pfexec pkg install SUNWgcc

will install gcc, if not already installed.

Fetch https://github.com/mcarpenter/lastlog/blob/master/lastlog.c and compile

 gcc lastlog.c -o lastlog

and invoke with

  • 2
    Solaris does not have a lastlog command, and you aren't even quoting a Solaris operating system manual page. This answer shows Linux operating system commands. The questioner already knows those, since xe asked for their Solaris equivalents. – JdeBP Jun 14 '18 at 6:38
  • The description of the command is for last, which is a Solaris command! – abu_bua Jun 14 '18 at 8:37
  • 2
    The "description of the command" is a verbatim copy of Miguel van Smooreburg's manual page for the last command on Linux. – JdeBP Jun 14 '18 at 10:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.