System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

/var/log/lastlog - huge file

SOLVED
Go to solution
Jees Joy
Frequent Advisor

/var/log/lastlog - huge file

Hi guys,

I have a question. On my HP DL585 box running RH4, I could see huge file around 273GB - /var/log/lastlog. Whats causing this to so big ?
7 REPLIES
Aleksandar Mitsev
Occasional Visitor

Re: /var/log/lastlog - huge file

Check the actual size with:

# du -h /var/log/lastlog

This file contains sparse blocks, the real size is correctly reported with command above
Ivan Ferreira
Honored Contributor

Re: /var/log/lastlog - huge file

That file is a log for sessions on your system, and you examine it by using lastlog. Every time a users login/logout from your system, the file is updated.

You should ensure that the file is included in your "logrotate" configuration and that "logrotate" is enabled.
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Jeeshan
Honored Contributor

Re: /var/log/lastlog - huge file

you can better do purge this file but before taking a backup.
a warrior never quits
Jeeshan
Honored Contributor

Re: /var/log/lastlog - huge file

you can better do purge this file but after takes a backup.
a warrior never quits
Jeeshan
Honored Contributor

Re: /var/log/lastlog - huge file

sorry, follow my last comment. (typo mistake)
a warrior never quits
Mike Stroyan
Honored Contributor
Solution

Re: /var/log/lastlog - huge file

The apparent size of /var/log/lastlog will correspond to the largest
uid that is recorded in it. The offset into the file can be really huge
for a uid that is a small negative number such as 'nobody'. With a 64-bit
system that can make a file that seems to be a terabyte in size. The file
is actually sparse, taking up little room on disk. But any copy utility
will have a very hard time with it because there is no way to seek to the
next non-zero block in such a file. The complete file will need to be
read to find the non-zero blocks. Clever commands such as cp can then
write the file out to a new location by seeking and creating a new sparse
file. But the full apparent size of the file will flood into the file
system buffer cache, pushing out more useful data.
Jees Joy
Frequent Advisor

Re: /var/log/lastlog - huge file

Thanks friends, those answers helped me thanks