/var/log/lastlog - huge file

[Jees Joy]

Hi guys,

I have a question. On my HP DL585 box running RH4, I could see huge file around 273GB - /var/log/lastlog. Whats causing this to so big ?

[Aleksandar Mitsev]

Check the actual size with:

# du -h /var/log/lastlog

This file contains sparse blocks, the real size is correctly reported with command above

[Ivan Ferreira]

That file is a log for sessions on your system, and you examine it by using lastlog. Every time a users login/logout from your system, the file is updated.

You should ensure that the file is included in your "logrotate" configuration and that "logrotate" is enabled.

[Jeeshan]

you can better do purge this file but before taking a backup.

[Jeeshan]

you can better do purge this file but after takes a backup.

[Jeeshan]

sorry, follow my last comment. (typo mistake)

[Mike Stroyan · Accepted solution]

The apparent size of /var/log/lastlog will correspond to the largest
uid that is recorded in it. The offset into the file can be really huge
for a uid that is a small negative number such as 'nobody'. With a 64-bit
system that can make a file that seems to be a terabyte in size. The file
is actually sparse, taking up little room on disk. But any copy utility
will have a very hard time with it because there is no way to seek to the
next non-zero block in such a file. The complete file will need to be
read to find the non-zero blocks. Clever commands such as cp can then
write the file out to a new location by seeking and creating a new sparse
file. But the full apparent size of the file will flood into the file
system buffer cache, pushing out more useful data.

[Jees Joy]

Thanks friends, those answers helped me thanks