The /etc/security/lastlog file is an ASCII file that contains stanzas with the last login attributes for users. Each stanza is identified by a user name and contains attributes in the Attribute=Value form. Each attribute is ended by a new-line
character, and each stanza is ended by an additional new-line character. Two stanzas for users (root & john) are shown in Figure below.
The mkuser command creates a user stanza in the lastlog file. The attributes of this user stanza are initially empty. The field values are set by the login command as a result of logging in to the system. The lsuser command displays the values of these attributes; the rmuser command removes the user stanza
from this file along with the user account.
Figure : /etc/security/lastlog stanzas