1

I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual filesystem they are on (/var is a 6G partition).

-rw-r--r--  3 root       root             65G Feb 11 08:33 faillog
-rw-------  3 root       root            129G Feb 11 08:33 tallylog
-rw-rw-r--  2 root       utmp            585G Feb 11 08:57 lastlog

Redhat says this is normal. Any way to limit the size on these? Can they be safely rotated every few hours?

Improve this question
4
  • Use du or ls -s to determine actual file size. The number shown by ls -l is not the file size, but the file length, which don't match for sparse files.
    – user10489
    Commented Mar 20, 2022 at 14:02
  • What? That makes absolutely no sense. -l is the short for listing format.
    – Nstevens
    Commented Mar 22, 2022 at 14:17
  • I always thought ls -l was "long format" not listing format, and the man page agrees. You could use ls -ls and get both size and length at once.
    – user10489
    Commented Mar 22, 2022 at 22:09
  • man lastlog says The lastlog file is a database which contains info on the last login of each user. You should not rotate it. It is a sparse file, so its size on the disk is usually much smaller than the one shown by "ls -l" (which can indicate a really big file if you have in passwd users with a high UID). You can display its real size with "ls -s".
    – Samveen
    Commented Feb 22 at 12:27

1 Answer 1

Reset to default
0

Redhat says this is normal. Any way to limit the size on these? Can they be safely rotated every few hours?

What RedHat says is that it's a sparse file. That's a file where the length of the file is larger than the content of the file; it has holes what doesn't contain any data.

To back up sparse files, use a tool that recognizes sparse files and can handle them correctly.

You should not rotate the files; that won't solve your problem. Rather, you should configure rsnapshot to use the --sparse flag. Or use a better backup tool. Or not back up those files.

Improve this answer
1
  • Thanks for the tip on the --sparse flag. I'll give it a shot.
    – Nstevens
    Commented Mar 22, 2022 at 14:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .