#! /usr/bin/perl -wT
# Simple mail log scanner to extract lost login date and time.

use strict;
use Date::Parse;

my $file = '/var/log/maillog';             # should be passed on the command line.
my $match = 'login';                       # string to match in the log.
my $year = "2013";                         # no year in the log.

my %login;                                 # hash of time stamps indexed by user.
my  ($month,$day,$time,$from,$user,$dum);

open(LOGFILE, $file ) or die("Could not open log file.");
foreach my $line (<LOGFILE>) {
    if ($line =~ /login/) {
        # there's much better ways to do this using regexs!
        # re-arange acording to your log format. 
        ($month,$day,$time,$dum,$dum,$dum,$from,$dum,$user) =  split(' ', $line);
        my $stamp = str2time("$day $month $year $time");

# use this to test dump every record.
# print "$stamp :: $day $month $time : $user - $from\n";

        # keep greatest $stamp in %login
        if ($login{$user}) {
           $login{$user} = $stamp if  $login{$user} < $stamp
        }
        else {
          $login{$user} = $stamp
        }
    }
}

print sprintf("%-30s%s\n",'User', 'Last Login');
foreach my $key (keys %login) {
    my $strtime = localtime($login{$key});
    print sprintf("%-30s%s\n",$key,$strtime);
}