/var/adm/lastlog size?

[Gärtner]

We observed on our clusters the /var/adm/lastlog files with same size. We did not find any explantions for this file, except the mentioning in "man login". Where is the size defined and can/should it be decreased?

ralf

[Steven Schweda · Accepted solution]

Why are you worried about the size of this
file?

Knowing nothing, I'd guess that "lastlog"
contains a 292-byte record for each UID
(who has ever logged in), addressed by UID*
292. (So root's entry is at byte 0 = 0* 292,
and my entry is at byte 58400 = 200* 292.)

If you want a smaller file, choose smaller
numbers for UIDs.

The "lastlog" data structure is defined in
/usr/include/lastlog.h, and the size macros
are defined in /usr/include/utmp_common.h.
4+ 32+ 256 = 292. My "lastlog" file has only
two entries, (root = 0, and me = 200), so
it's pretty easy to see the pattern here:

urtx# od -x /usr/adm/lastlog
0000000 badf 46cb 7470 2f73 0030 0000 0000 0000
0000020 0000 0000 0000 0000 0000 0000 0000 0000
0000040 0000 0000 6c61 2e70 6e61 6974 6f6e 6564
0000060 6f2e 6772 0000 0000 0000 0000 0000 0000
0000100 0000 0000 0000 0000 0000 0000 0000 0000
*
0162040 6292 466c 7470 2f73 0031 0000 0000 0000
0162060 0000 0000 0000 0000 0000 0000 0000 0000
0162100 0000 0000 6c61 2e70 6e61 6974 6f6e 6564
0162120 6f2e 6772 0000 0000 0000 0000 0000 0000
0162140 0000 0000 0000 0000 0000 0000 0000 0000
*
0162504

urtx# ls -lL /usr/adm/lastlog
-rw-r--r-- 1 root adm 58692 Aug 21 23:26 /usr/adm/lastlog

note that 201* 292 = 58692 (= 0o162504).

[Rob Leadbeater]

Hi Ralf,

On a clustered system, /var/adm/lastlog should be a CDSL (cluster dependant symbolic link). If it's the same size on more than one node, that implies that the CDSL has been broken. Check with ls -l. You should see it pointing to something like:

../cluster/members/{memb}/adm/lastlog

Hope this helps,

Regards,

Rob

[Gärtner]

Thanks for answers. As Steven pointed out, the file size seem to depend on the UID. I could verify, that even after removing the file (on a test system), a new with a identical, large size has been created immediatly after logging in. But I have also seen a lastlog file with 292000000 bytes on a system with 986578 as highest UID. So the size is a multiple of 292 but not be a multiple of the highest existing UID.

The reason for the question was that we inherited some smaller systems with these large files.

Ralf

[Steven Schweda]

> [...] If it's the same size on more than
> one node, that implies that the CDSL has
> been broken. [...]

Or that all the systems have the same largest
UID.

> So the size is a multiple of 292 but not be
> a multiple of the highest existing UID.

Knowing nothing, I can't say, but someone
might have a round-up policy on that file
size. Interesting.

> [...] we inherited some smaller systems
> with these large files.

Shouldn't smaller systems have smaller
largest UIDs?

> [...] 292000000 bytes [...] 986578 as
> highest UID [...]

I'd say that that's big. Well, at least we
now know a good reason to use smaller UID
values. (Maybe it's a sparse file, so it's
not really as bad (large) as it looks?)

[Kapil Jha]

Hello Stevan
I have a doubt you said size would be uid*292+uid1*292.....
in your case root's uid was 0 and yours 200.
So size should be 0*292+200*292=58400
but ur file size is 58692(58400+262) ????
could you please explain this.
BR,
Kapil

[Steven Schweda]

> you said size would be uid*292+uid1*292.....

No, what I said was:

> Knowing nothing, I'd guess that "lastlog"
> contains a 292-byte record for each UID
> (who has ever logged in), addressed by UID*
> 292. (So root's entry is at byte 0 = 0* 292,
> and my entry is at byte 58400 = 200* 292.)

That is, the record for a UID _starts_ at
UID* 292. It _ends_ 291 bytes later. The
file _size_ is the number of records times
the size of a record, that is, (1+ max(UID))*
292 bytes.