4

This question is in relation to the lastlog file size explained in this article

http://www.noah.org/wiki/Lastlog_is_gigantic

I understand it is being created as a sparse file hence the size.

Here's the problem I'm having: /var/log in my case is mounted under a location which only allocated 2GB and assume I can't change that.

In my case lastlog pre allocated ~5GB yet when I do df -h /var/log seems OK, however after a certain amount of time of activity on the box (hours usually) df -h suddenly reports 100% disk space utilisation and when I delete lastlog it drops to 1% again.

If I repeat this process with touch lastlog it happens again.

So, my questionS, and again assume I can't change the mount size,

  1. Any idea why is it happening after few hours and not immidiately when new laslogf file is touched?

  2. Is there a way to control the size which lastlog pre allocates or reduce the number of users it thinks are going to use the system in order to get it to less than 2GB?

I've also read this but rather not play with uids if possible

https://askubuntu.com/questions/618608/lastlog-grows-to-4-2g-after-ssh-logout

4
  • Getting such a big lastlog is a sign that you have very high UIDs in your system. This is potentially cause for concern as in most systems, you just have a few thousand IDs at the maximum. Check what the highest UIDs are, if the they are legitimate and if they legitimately can login to the machine.
    – Sven
    Jul 22, 2016 at 13:39
  • They are valid users
    – Joly
    Jul 22, 2016 at 14:28
  • Then I believe your only option is to alter the user to have a more usable uid to work within your constraints and maybe check if the location that mounts your /var is able to handle sparse files - even having one user with a very large uid should keep the actual disk usage still small.
    – Sven
    Jul 22, 2016 at 14:38
  • Here are some links to the bug reports in Redhat / fedora and ubuntu. Hopefully, more people will call attention to this issue and it will get some attention. bugs.launchpad.net/ubuntu/+source/util-linux/+bug/1707645 bugzilla.redhat.com/show_bug.cgi?id=951564
    – nelaaro
    Oct 26, 2018 at 10:15

1 Answer 1

0

There is no work around to fix this.

It would require not trivial changes to rebuild the affect component in Linux.

The ubuntu bug lists them as PAM, shadow, util-linux. If these change how other applications work with them then their is a large cascading set of changes.

People are reluctant to work on this issue. Which has been know in redhat since 2013.

Here are some links to the bug reports in Redhat / fedora and ubuntu. Hopefully, more people will call attention to this issue and it will get some attention.

http://bugs.launchpad.net/ubuntu/+source/util-linux/+bug/1707645
http://bugzilla.redhat.com/show_bug.cgi?id=951564

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .