lastlog file size is HUGE..!!
Dear All,
In one of my server running on RHEL5.10 32-Bit Arch the lastlog size too big.
Which is causing a CPU spike when I try to copy/backup the file.
The server goes hung. Can someone help on fixing this.
When Backup is initiated the server goes HUNG due to out of CPU...!!!!
[root@test log]# du -sh lastlog
184K lastlog
[root@test log]# du -sb lastlog
292088859104 lastlog
[root@test log]#
[root@test ~]# vgs
VG #PV #LV #SN Attr VSize VFree
VolGroup00 1 5 0 wz--n- 278.34G 191.44G
[root@test ~]# ls -lh /var/log/lastlog
-rw-r--r-- 1 root root 273G Apr 16 11:43 /var/log/lastlog
[root@test ~]#
Responses
What are you using to back up the log file? The lastlog is generally implemented as a sparsefile data structure (thus, it's not actually consuming as much space on disk as ls leads you to believe). If your backup utility/methodology isn't sparesfile-aware, you'll run into the issues you've described.
I came across this today with a centos7 system (fully patched),
The partition is 4G (/var/log), however ls -lh /var/log/lastlog believes it is 465GB (four hundred and sixty-five GB). However, a df -PhT /var/log shows only 65M (sixty-five MB) being actually used. The /var/log is on an xfs local file system.
I found this link http://www.noah.org/wiki/Lastlog_is_gigantic which speaks of what Tom mentions above. Additionally see this link https://access.redhat.com/articles/3314
Theres an easy way to find out the amount of space the file is really taking. Try adding the --size (-s) flag when you're running the ls command.
[root@redacted log]# ls -lh --size lastlog 40K -rw-r--r--. 1 root root 400G Jul 13 16:25 lastlog
The previous posters have correctly identified it's a sparse file, but the --size flag is a nice way of seeing that. Good luck Manikandan.
Peter Rhodes.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
