topic Re: /var/log/lastlog - huge file in Operating System - Linux

/var/log/lastlog - huge file

Jees Joy — Thu, 03 Jul 2008 01:44:20 GMT

Hi guys,

I have a question. On my HP DL585 box running RH4, I could see huge file around 273GB - /var/log/lastlog. Whats causing this to so big ?

Re: /var/log/lastlog - huge file

Aleksandar Mitsev — Fri, 04 Jul 2008 06:27:15 GMT

Check the actual size with:

# du -h /var/log/lastlog

This file contains sparse blocks, the real size is correctly reported with command above

Re: /var/log/lastlog - huge file

Ivan Ferreira — Fri, 04 Jul 2008 12:38:28 GMT

That file is a log for sessions on your system, and you examine it by using lastlog. Every time a users login/logout from your system, the file is updated.

You should ensure that the file is included in your "logrotate" configuration and that "logrotate" is enabled.

Re: /var/log/lastlog - huge file

Jeeshan — Sun, 06 Jul 2008 11:41:24 GMT

you can better do purge this file but before taking a backup.

Re: /var/log/lastlog - huge file

Jeeshan — Sun, 06 Jul 2008 11:41:48 GMT

you can better do purge this file but after takes a backup.

Re: /var/log/lastlog - huge file

Jeeshan — Sun, 06 Jul 2008 11:42:25 GMT

sorry, follow my last comment. (typo mistake)

Re: /var/log/lastlog - huge file

Mike Stroyan — Sun, 06 Jul 2008 20:36:15 GMT

The apparent size of /var/log/lastlog will correspond to the largest
uid that is recorded in it. The offset into the file can be really huge
for a uid that is a small negative number such as 'nobody'. With a 64-bit
system that can make a file that seems to be a terabyte in size. The file
is actually sparse, taking up little room on disk. But any copy utility
will have a very hard time with it because there is no way to seek to the
next non-zero block in such a file. The complete file will need to be
read to find the non-zero blocks. Clever commands such as cp can then
write the file out to a new location by seeking and creating a new sparse
file. But the full apparent size of the file will flood into the file
system buffer cache, pushing out more useful data.

Re: /var/log/lastlog - huge file

Jees Joy — Wed, 09 Jul 2008 07:36:27 GMT

Thanks friends, those answers helped me thanks