PHV, This is what I have now
cd /tcb/files/auth
awk -F: '
{for(i=1;i<=NF;++i)if($i~/unsuclog/){d=$i;sub(/.*#/,"",d);print substr(FILENAME,
3),d}}
' ?/* | while read user date
do echo "$user\t`perl -e 'use POSIX;print ctime($date)'`"
done
This is the result
dpalmer Wed Dec 31 19:00:00 1969...