please advise the equivalent command of linux lastlog in solaris, need to write a script to find the the users last login date and time in solaris servers. Linux its very easy to fetch using lastlog command.

I tried last -1 USERID , if any user not logged in that server then there is no ouptut , the task is to find the users who not logged in server more that 90 days, a script should give the output as

ServerName USERID 10-Jun-2018 3Days

There is no direct equivalent to the Linux lastlog command, that is supplied with the operating system.

In the Linux login accounting system there is a table that records the last login time of each user account, indexed by that account's user ID. In the NetBSD, FreeBSD, and OpenBSD login accounting systems, there is an equivalent table (albeit with a different structure and name), and (in the NetBSD and FreeBSD systems) a lastlogin command that dates from the middle 1990s. In both the Linux and BSD worlds, this table is updated by the same programs that write the login log table and the currently active logins table, two other tables in the login database.

Solaris has two tables: an equivalent one, and one that is not quite equivalent.

The last command, that other people are pointing to, is not particularly useful because it does not operate from either one. It operates off a different table in the login accounting database, the log of login events table; and as you can see if an account has never logged in there will be nothing in that table to process. Whereas, in contrast, with the last login time table there is a record (on the BSDs an empty implicit one, on Linux an explicit empty one) for every user account.

The Solaris table that is not quite equivalent is /var/adm/acct/sum/loginlog. This is not directly populated by the login program as logins happen, and there is no directly equivalent program for reporting on it.

It is associated with a lastlogin command; however, that is quite different to the aforementioned command by that name. On Solaris, it is a tool for writing to this table rather than a tool for reporting upon its contents. (This is also what lastlogin is for on AIX.) The runacct tool, run daily, invokes the lastlogin command to populate this table. Reporting is done with the prtacct command.

The Solaris table that is directly equivalent is /var/adm/lastlog, which is not mentioned in Oracle doco. There is no program supplied for reading it. However, there was (until the software died at Oracle) a third party lastlog program written by Richard Hamilton available. You might like to convince the OpenIndiana/Illumos people to incorporate such a command. Dan McDonald, OmniOS engineer, was touching this stuff as recently as January 2016.

Further reading

• Jonathan de Boyne Pollard (2018). The Unix login database. Frequently Given Answers.


• "System Accounting Files". System Administration Guide: Advanced Administration. Oracle Solaris 10 8/11 Information Library. Oracle. 2011.


• 
  lastlog. Oracle Solaris Blog. 2010-07-15.


• 
  lastlogin. FreeBSD System Manager's Manual. 2011-06-06.


• 
  last. User Commands Manual. Illumos. 2017-04-12.


• 
  acctsh. System Administration Commands. SunOS 5.11. 2002-03-15.

The command for that in Solaris is last.

This will show you the last time the user tim logged in.

bash-[510]$ last -1 tim
tim pts/1 192.168.0.106 Wed Jun 13 18:16 still logged in

If that user hasn't logged in since the db has been rotated, you won't get any output.

bash-[511]$ last -1 tom

wtmp begins Fri Mar 27 19:57

Oracle Solaris also offers a nice tool called

acct

You can find a description on the following link Sytem Accounting.

In the directory /var/adm/acct/sum you will find a file called loginlog. This file record the last date each user logged in and is created by the lastlogin script.

Based on this file and using e.g. awk it should be very simple to fullfill your requires.

I think the command you are searching for is the last command.

NAME

last, lastb - show a listing of last logged in users

SYNOPSIS
last [options] [username...] [tty...]
lastb [options] [username...] [tty...]

DESCRIPTION
last searches back through the /var/log/wtmp file (or the file designated by the -f option) and displays a list of all
users logged in (and out) since that file was created. One or more usernames and/or ttys can be given, in which case last
will show only the entries matching those arguments. Names of ttys can be abbreviated, thus last 0 is the same as last
tty0.

When catching a SIGINT signal (generated by the interrupt key, usually control-C) or a SIGQUIT signal, last will show how
far it has searched through the file; in the case of the SIGINT signal last will then terminate.

The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all the reboots
since the log file was created.
lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad
login attempts.

Otherwise lastlog as you mentioned:

lastlog -b 90