[ale] lastlog

[Chris Ricker]

On Mon, 19 Dec 2005, James P. Kinney III wrote:

> My /var/log/lastlog shows a file size of 1.2T.
> 
> It would be kind of cool if that were possible. But I don't _have_ even
> 1T of drive space on the machine. 
> 
> So a digging around of man pages shows lastlog as _always_ having a
> bogus large file size. ls -s shows it as 60(B) while ls -h shows 1.2T
> 
> Does ext(3) have issues with sparse files (which is what lastlog is)?

That's more-or-less normal. The apparent size (ls -h) of lastlog will vary 
with architecture, vendor, Unix flavor, UIDs on the system, etc., but it 
should be sparse and will likely appear huge (for some value of huge ;-)

The idea is that lastlog is indexed by uid but is sparse so you don't 
waste disk space. The huge sparseness you're seeing is because nfsnobody 
on your OS is uid -1. nfsnobody uid of -1 on x86_64 is 4294967294, and 
indexing to 4294967294 reserves 1.2 terabytes

ext3 is fine with it, but your utils (tar, cpio, etc) may or may not do 
what you want -- treat it as a sparse file, rather than as a really long 
really compressible string -- depending on rev, vendor, options used, etc.

later,
chris