Lastlog actually is huge

Latest response

I have one RHEL server running in an lxc container that has a lastlog that is reporting (via ls) as being 9.7G in size. I know that lastlog is usually a sparse file and the reported filesize is normally only a few Kb. In this case however, du is showing that the file is ACTUALLY 9.7G.

# ls -lh lastlog
-rw-r--r-- 1 root root 9.7G Dec  9 07:35 lastlog
# du -hs lastlog
9.7G    lastlog

On other identical (RHEL running in lxc container) systems (on same container host), I can see that lastlog IS a sparsefile:

# ls -lh lastlog
-rw-r--r--. 1 root root 9.7G Dec  9 07:46 lastlog
# du -sh lastlog
40K lastlog

My question is this: Is it safe to just delete the huge file while the system is running and will the process that writes to it (presumably PAM), automatically re-create it.

FD

Responses