Lastlog actually is huge
I have one RHEL server running in an lxc container that has a lastlog that is reporting (via ls) as being 9.7G in size. I know that lastlog is usually a sparse file and the reported filesize is normally only a few Kb. In this case however, du is showing that the file is ACTUALLY 9.7G.
# ls -lh lastlog -rw-r--r-- 1 root root 9.7G Dec 9 07:35 lastlog # du -hs lastlog 9.7G lastlog
On other identical (RHEL running in lxc container) systems (on same container host), I can see that lastlog IS a sparsefile:
# ls -lh lastlog -rw-r--r--. 1 root root 9.7G Dec 9 07:46 lastlog # du -sh lastlog 40K lastlog
My question is this: Is it safe to just delete the huge file while the system is running and will the process that writes to it (presumably PAM), automatically re-create it.
Responses