[Pkg-shadow-devel] Strange things with lastlog

[Nicolas François]

On Thu, Apr 21, 2005 at 05:04:33PM +0200, Christian Perrier wrote:
> On a woody machine of mine (critical samba server):
> 
> root@bellini:/var/log# ls -l lastlog
> -rw-rw-r--    1 root     utmp     289073576 avr 21 16:50 lastlog
> root@bellini:/var/log# du -sk lastlog
> 175     lastlog
> root@bellini:/var/log# LC_ALL=C df -k .
> Filesystem           1k-blocks      Used Available Use% Mounted on
> /dev/sda7               396500    179229    196790  48% /var

That's normal. lastlog is a sparse file (it contains mostly zeros, which
are not written on the disk). "du -sk" or "ls -s" show you the size on the
disk, and "ls -l" show you how far you can seek in this file.

However, 289073576 is quite big and probably means you have or have had
users with high UID (around 1000000?). It should not be that big that it
breaks lastlog (Large File Support issue: #280212, fixed upstream).

> We found this because someone inadvertently ran "grep something *" in
> /var/log and the machine very quickly exhausted its memory, ran out of
> resources, and began stopping processes...:-)

It is also normal that grep take a long time to parse this file (because
it can seek into it). It may exhaust its memory because it tries to read a
line which never ends.


> I wonder whether this could be related to the various "lastlog"
> problems we have found up to now....


Here are the bugs related to lastlog:

 #275112 [TO CLOSE 20050324] login: Lastlog shows incorrect data
  (unreproducible, no answer from the submitter)
  I don't think it is related to this issue.
 #219321 Need logrotate def for lastlog
   It is a little bit related, because I think the submitter thought the
   file was really big, while it is not.
   This file don't need to be rotated. It is not a log of the last login,
   it is a table with the last log of each users.

   I will close this bug.
 #259494
   unreproducible for me
 #280212 lastlog: fails when high UID's present
   This bug deals with really big lastlog files (in ls -l).
   It may be solved by just adding `getconf LFS_CFLAGS` to CFLAGS.
   I will try to reproduce it and make a short patch taken from upstream
   (if we don't release upstream version earlier). It is not a priority.
 
However, lastlog being a sparse file could be a FAQ. It could be nice to
mention it in lastlog(8) man page.

-- 
Nekral