0

I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual filesystem they are on (/var is a 6G partition).

-rw-r--r--  3 root       root             65G Feb 11 08:33 faillog
-rw-------  3 root       root            129G Feb 11 08:33 tallylog
-rw-rw-r--  2 root       utmp            585G Feb 11 08:57 lastlog

Redhat says this is normal. Any way to limit the size on these? Can they be safely rotated every few hours?

Improve this question
3
  • Use du or ls -s to determine actual file size. The number shown by ls -l is not the file size, but the file length, which don't match for sparse files.
    – user10489
    Mar 20, 2022 at 14:02
  • What? That makes absolutely no sense. -l is the short for listing format.
    – Nstevens
    Mar 22, 2022 at 14:17
  • I always thought ls -l was "long format" not listing format, and the man page agrees. You could use ls -ls and get both size and length at once.
    – user10489
    Mar 22, 2022 at 22:09

1 Answer 1

Reset to default
0

Redhat says this is normal. Any way to limit the size on these? Can they be safely rotated every few hours?

What RedHat says is that it's a sparse file. That's a file where the length of the file is larger than the content of the file; it has holes what doesn't contain any data.

To back up sparse files, use a tool that recognizes sparse files and can handle them correctly.

You should not rotate the files; that won't solve your problem. Rather, you should configure rsnapshot to use the --sparse flag. Or use a better backup tool. Or not back up those files.

Improve this answer
1
  • Thanks for the tip on the --sparse flag. I'll give it a shot.
    – Nstevens
    Mar 22, 2022 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.