in reply to Reporting last login according to wtmp for selected users

(untested)
#!/usr/local/bin/perl # # Show last logins for every user in /etc/passwd use strict; use warnings; # only report on users with this in their home dir path: my $special = 'foo'; my %user; my $begin; open LASTLOGIN, "last |" or die "Error runing 'last' - $!\n"; while (<LASTLOGIN>) { next unless /\S/; if ( /^wtmp begin/ ) { $begin = $_; } else { my($name,$tty,@date) = split; $user{$name} ||= "@date[0..3]"; # include time of login too. } } close LASTLOGIN; print $begin; open PASSWD, "/etc/passwd" or die "Error opening /etc/passwd for read +- $!\n"; while (<PASSWD>) { my($name,$homedir) = (split ':')[0,4]; $user{$name} ||= "**No Logon Since /etc/wtmp File Created**"; $homedir =~ /$special/ or delete $user{$name}; } close PASSWD; foreach my $name ( sort keys %user ) { printf "%-10s %s\n", $name, $user{$name}; }