[Pkg-shadow-devel] Strange things with lastlog

[Tomasz Kłoczko]

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--568760595-267202841-1114110297=:6082
Content-Type: TEXT/PLAIN; charset=ISO-8859-2
Content-Transfer-Encoding: QUOTED-PRINTABLE

On Thu, 21 Apr 2005, Nicolas [iso-8859-1] Fran=E7ois wrote:

> On Thu, Apr 21, 2005 at 05:04:33PM +0200, Christian Perrier wrote:
> > On a woody machine of mine (critical samba server):
> >=20
> > root@bellini:/var/log# ls -l lastlog
> > -rw-rw-r--    1 root     utmp     289073576 avr 21 16:50 lastlog
> > root@bellini:/var/log# du -sk lastlog
> > 175     lastlog
> > root@bellini:/var/log# LC_ALL=3DC df -k .
> > Filesystem           1k-blocks      Used Available Use% Mounted on
> > /dev/sda7               396500    179229    196790  48% /var
>=20
> That's normal. lastlog is a sparse file (it contains mostly zeros, which
> are not written on the disk). "du -sk" or "ls -s" show you the size on th=
e
> disk, and "ls -l" show you how far you can seek in this file.
>=20
> However, 289073576 is quite big and probably means you have or have had
> users with high UID (around 1000000?). It should not be that big that it
> breaks lastlog (Large File Support issue: #280212, fixed upstream).

Name this file suggest is is log file. This may suggest this file may=20
grow. Usual way of thinking is: lastlog -> log file -> it may grow -> wow=
=20
it is so big :> -> I must do something for reduce "size" this file :)

But realy lastlog mean "*last* *log*in _database_" indexed by=20
uid. Example from my case:

# ls -l /var/log/lastlog
-r--------  1 root root 19136220 Apr 21 19:21 lastlog
                        ^^^^^^^^
=09=09=09=09looks lik ~20GB :)
but:
# du -h /var/log/lastlog
56K     lastlog
^^^
   he .. only 56KB :)

So question is: why ? A: because this file usualy have holes.=20
Because ls output shows incomplet data aboutthis file. Even 289073576 size=
=20
showed by ls output can be nothink strange. It must be verified by du
output. File size and file length it may be two driffrent values :)=20
lastlog lenght showed by ls determined by higher UID used by some user
registered in system.

kloczek
--=20
-----------------------------------------------------------
*Ludzie nie maj=B1 problem=F3w, tylko sobie sami je stwarzaj=B1*
-----------------------------------------------------------
Tomasz K=B3oczko, sys adm @zie.pg.gda.pl|*e-mail: kloczek@rudy.mif.pg.gda.p=
l*
--568760595-267202841-1114110297=:6082--