5

Running a VPS with Ubuntu 12.04.5 LTS. Noticed a spike in disk usage. Turns out the culprit is lastlog. Overwrote it with >/var/log/lastlog.

After logging out of the session and logging back in, lastlog increases in size again:

-rw-rw-r-- 1 root utmp 4.2G May  5 06:32 /var/log/lastlog

Is this something known? How can I stop lastlog from using up so much space?

Thank you!

Improve this question
7
  • What is printed? It sounds like you have an error that is producing a lot of output. Have you actually checked the logs?
    – terdon
    May 5, 2015 at 13:42
  • I can't really open a 4GB log on a VPS.
    – Mr. Silens
    May 5, 2015 at 13:46
  • Try tail /var/log/lastlog. That'll show the last 10 lines of the log. If 10 lines isn't enough, try tail -n NUM /var/log/lastlog, where NUM is the number of lines from the bottom you want to show.
    – zhongfu
    May 5, 2015 at 13:47
  • Added both to OP. Tried tail - it hangs with no output.
    – Mr. Silens
    May 5, 2015 at 14:13
  • 1
    Here are some links to the bug reports in Redhat / fedora and ubuntu. Hopefully, more people will call attention to this issue and it will get some attention. bugs.launchpad.net/ubuntu/+source/util-linux/+bug/1707645 bugzilla.redhat.com/show_bug.cgi?id=951564
    – nelaaro
    Oct 26, 2018 at 10:04

2 Answers 2

Reset to default
6

/var/log/lastlog is a sparse file meaning its real size is not reported by ls -l but by ls -s. This means that your lastlog might not be as huge as you think:

Try:

ls -s /var/log/lastlog

to get a report of its size in blocks.

The sudden growth of /var/log/lastlog means a high UID user as logged out. Look at lastlog man page

Edit - To fix it:

You can found out the last logged out user by using lastlog command.

And after making sure the user is not logged in with w command, change its UID. See how in "How to change user gid and uid"

Then clear /var/log/lastlog like you already did with 

> /var/log/lastlog

Note: Using an uid of 6565666, I only got 1.8G for /var/log/lastlog. So your user must have an uid higher than 26262664 ???

Improve this answer
3
  • 1
    I'ts a good answer +1
    – A.B.
    May 5, 2015 at 15:31
  • I understood it is a sparse file, but the VPS dashboard actually counts it's size in the space used. lastlog is indeed just 4 blocks. Is there something that I can do about it?
    – Mr. Silens
    May 5, 2015 at 15:37
  • Change the high UID of user in /etc/passwd to a smaller one ? Find that user in lastlog output (the command not the file /var/log/lastlog). Mark above solution as accepted if it works. Thanks.
    – solsTiCe
    May 5, 2015 at 15:44
0

As already explained in the accepted answer, this is a sparse file which is not really as big as it seems.

However, this can be a problem with backups where the backup file actually will be that big. So for others landing here as I did because the backups are getting too large:

If doing backups of /var/log, do them with rsync and use its --sparse (or -S) option.

From man rsync :

-S, --sparse

Try to handle sparse files efficiently so they take up less space on the destination.

If combined with --inplace the file created might not end up with sparse blocks with some combinations of kernel version and/or filesystem type. If --whole-file is in effect (e.g. for a local copy) then it will always work because rsync truncates the file prior to writing out the updated version.

Note that versions of rsync older than 3.1.3 will reject the combination of --sparse and --inplace.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.