Re: Bug#66733: [potato] /var/log/lastlog not rotated

[Brian May <bam@debian.org>]

>>>>> "Jeff" == Jeff Lightfoot <jeffml@mail.com> writes:

    Jeff> I don't have an answer but it looks as though there was good
    Jeff> reason to stop rotating it.

There is no reason to rotate it. See the archived bug report at:
http://cgi.debian.org/cgi-bin/bugreport.cgi?archive=yes&bug=43422

I quote some important points:

---- cut ----
No. It's a file with holes in it. If you do an "ls" it might _seem_
like it uses a lot of megabytes but it doesn't use that space on
disk. That is called a "sparse file" and is a standard Unix feature.

Look:

# cd /var/log
# ll lastlog 
-rw-r--r--   1 root     root      3279160 Aug 24 11:27 lastlog
# du lastlog
145     lastlog
# 
---- cut ----

---- cut ----
As far as I know the file is only an array of[1]

struct lastlog
  {
    __time_t ll_time;
    char ll_line[UT_LINESIZE];
    char ll_host[UT_HOSTSIZE];
  };

The array size should be the number of accounts (in the worst case
2^15-1).  If it grows without adding new accounts, this is a bug which 
should be filed against the login package.  But truncating the file
should normally not be needed.
---- cut ----

ie, it is not a log file in the normal sense.
-- 
Brian May <bam@debian.org>