Thanks. For others who don't have helpful man pages: on Solaris, at least, it's in /var/adm, and the structure of the file can be deciphered from /usr/include/lastlog.h: my $struct_lastlog = "L a8 a16";