This question is in relation to the lastlog file size explained in this article
http://www.noah.org/wiki/Lastlog_is_gigantic
I understand it is being created as a sparse file hence the size.
Here's the problem I'm having: /var/log in my case is mounted under a location which only allocated 2GB and assume I can't change that.
In my case lastlog pre allocated ~5GB yet when I do df -h /var/log seems OK, however after a certain amount of time of activity on the box (hours usually) df -h suddenly reports 100% disk space utilisation and when I delete lastlog it drops to 1% again.
If I repeat this process with touch lastlog it happens again.
So, my questionS, and again assume I can't change the mount size,
-
Any idea why is it happening after few hours and not immidiately when new laslogf file is touched?
-
Is there a way to control the size which lastlog pre allocates or reduce the number of users it thinks are going to use the system in order to get it to less than 2GB?
I've also read this but rather not play with uids if possible
https://askubuntu.com/questions/618608/lastlog-grows-to-4-2g-after-ssh-logout
Best Answer
There is no work around to fix this.
It would require not trivial changes to rebuild the affect component in Linux.
The ubuntu bug lists them as PAM, shadow, util-linux. If these change how other applications work with them then their is a large cascading set of changes.
People are reluctant to work on this issue. Which has been know in redhat since 2013.
Here are some links to the bug reports in Redhat / fedora and ubuntu. Hopefully, more people will call attention to this issue and it will get some attention.
http://bugs.launchpad.net/ubuntu/+source/util-linux/+bug/1707645
http://bugzilla.redhat.com/show_bug.cgi?id=951564