Figure 1: Sample output from lastlog

Linux lastlog:

jeff   ttyp3 duffel.net       Sun Aug 4 14:07 still logged in
jeff   ttyp2 duffel.net       Sun Aug 4 11:47 still logged in
jeff   ttyp3 duffel.net       Fri Aug 2 18:08 - 14:07 (1+19:58)
jeff   ttyp2 duffel.net       Fri Aug 2 17:53 - 11:47 (1+17:53)

Solaris 2.5 lastlog:

jeff   pts/0 strange          Sun Aug 4 11:20 still logged in
smith  ftp   netcom.com       Sun Aug 4 10:08 - 10:15 (00:07)
backup ftp   mailhost.duffel. Sun Aug 4 04:59 - 05:00 (00:00)
backup ftp   frodo.duffel.net Sun Aug 4 03:21 - 03:39 (00:17)
backup ftp   ns2.duffel.net   Sun Aug 4 02:02 - 02:02 (00:00)
backup ftp   eomer.duffel.net Sun Aug 4 00:27 - 00:53 (00:26)
tgif   ftp   www.yourcompany. Sat Aug 3 13:31 - 13:34 (01:29)

lastlog example from a machine with a heavy used ftp site:

ftp    ftp   dial04189.netviX Sun Aug 4 00:08 - 00:48 (00:39)
ftp    ftp   XXX.170.136.134  Sun Aug 4 00:08 - 00:16 (00:08)
ftp    ftp   tac-pm1-ip2.XX.n Sun Aug 4 00:06 - 01:08 (01:02)
ftp    ftp   tac-pm1-ip2.XX.n Sun Aug 4 00:04 - 00:05 (00:01)
ftp    ftp   XXX.171.140.188  Sun Aug 4 00:04 - 00:20 (00:16)
mary   ftp   XXX.171.30.229   Sun Aug 4 00:03 - 04:22 (04:18)
ohn    ftp   XXX-152-156.ipt. Sun Aug 4 00:02 - 00:12 (00:10)
ftp    ftp   XX.169.225.213   Sun Aug 4 00:00 - 00:32 (00:32)