This question is in relation to the lastlog file size explained in this article
http://www.noah.org/wiki/Lastlog_is_gigantic
I understand it is being created as a sparse file hence the size.
Here's the problem I'm having: /var/log
in my case is mounted under a location which only allocated 2GB and assume I can't change that.
In my case lastlog pre allocated ~5GB yet when I do df -h /var/log
seems OK, however after a certain amount of time of activity on the box (hours usually) df -h
suddenly reports 100% disk space utilisation and when I delete lastlog it drops to 1% again.
If I repeat this process with touch lastlog it happens again.
So, my questionS, and again assume I can't change the mount size,
Any idea why is it happening after few hours and not immidiately when new laslogf file is touched?
Is there a way to control the size which lastlog pre allocates or reduce the number of users it thinks are going to use the system in order to get it to less than 2GB?
I've also read this but rather not play with uids if possible
https://askubuntu.com/questions/618608/lastlog-grows-to-4-2g-after-ssh-logout
lastlog
is a sign that you have very high UIDs in your system. This is potentially cause for concern as in most systems, you just have a few thousand IDs at the maximum. Check what the highest UIDs are, if the they are legitimate and if they legitimately can login to the machine.uid
to work within your constraints and maybe check if the location that mounts your/var
is able to handle sparse files - even having one user with a very largeuid
should keep the actual disk usage still small.