[Bug 1707645] Re: system with high numbered uids has huge sparse /var/log/lastlog

[Seth Arnold]

Oliver, from the lastlog(8) manpage:

       The lastlog file is a database which contains info on the
       last login of each user. You should not rotate it. It is a
       sparse file, so its size on the disk is usually much smaller
       than the one shown by "ls -l" (which can indicate a really
       big file if you have in passwd users with a high UID). You
       can display its real size with "ls -s".

http://manpages.ubuntu.com/manpages/focal/man8/lastlog.8.html

If you're using a filesystem that can't handle sparse files it might be
best to not use lastlog.

Thanks

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to util-linux in Ubuntu.
https://bugs.launchpad.net/bugs/1707645

Title:
  system with high numbered uids has huge sparse /var/log/lastlog

Status in pam package in Ubuntu:
  Confirmed
Status in shadow package in Ubuntu:
  Confirmed
Status in util-linux package in Ubuntu:
  Confirmed

Bug description:
  I was investigating the use of a single high UID user (ie, 2000000000)
  and discovered that /var/log/lastlog grew to an enormously large
  sparse file:

  $ ls -lh /var/log/lastlog 
  -rw-rw-r-- 1 root utmp 544G Jul 27 12:35 /var/log/lastlog

  The file is actually quite small though:
  $ ls -lh --size /var/log/lastlog 
  56K -rw-rw-r-- 1 root utmp 544G Jul 27 12:35 /var/log/lastlog

  On a standalone system, this is possibly not a problem since it is
  highly unlikely that a system will have 2 billion users, but this is
  confirmed to wreak havoc on rsync backups.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pam/+bug/1707645/+subscriptions