Re: Help: my /var/log/lastlog's as big as Canarsie!

[montefin <montefin@finux.com>]

Holy Canarsie, Miquel!

You are absolutely right, 'du /var/log/lastlog' does show the file to be
miniscule. Whew!

Miquel van Smoorenburg wrote:
> 
> montefin  <montefin@finux.com> wrote:
> >Has anyone else encountered this situation?
> 
> Yes, almost everyone.
>

I wonder how come no one in #linux knew about it? Too bad no one in
#debian ever speaks (at least to me), surely they would have known?
 
>
> >I was looking at my /var/log directory and this popped out at me
> >-rw-rw-r--   1 root     utmp       18692964 May 17 04:19 lastlog
> > 
> No. Do a "du /var/log/lastlog" - you'll see that it's just a few K.
>

I loaf this country! Where else can 18692964 of anything equal 12000?
And /var/log/faillog isn't 1536408 either, it's just 7000. And Alan
Greenspan is worried about inflation? Hah!
 
> 
> That isn't quite what the manual page says, the manpage is confusing
> and incomplete though.
>

Right again, Miquel! The man page says exactly

"CAVEATS
       Large gaps in uid numbers will cause  the  lastlog  program  to 
run
       longer  with  no  output  to  the  screen (i.e. if mmdf=800 and
last
       uid=170, program will appear to hang as it processes uid
171-799)."

Hmmmmm, kinda sounds like

> >'man lastlog' does have a cautionary statement about wide gaps in uid
> >#'s slowing down the time it takes for lastlog to print to screen when a
> >user logs in.

> 
> This is a feature of Unix called "sparse files".
>

This is a feature? Now I am amazed ;)

> 
> Someone should fix/update the manpage though:
> 
> - explain how the lastlog file works, 
> 

Mike, please sir, just how does the lastlog file work? 

Actually, maybe the manual page should be left just they way it is so we
can direct newbies like me to it on Halloween.

Anyway, I feel much better now...I think. Er...lemme go reread the 'du'
manual page, and maybe the 'ls' manual page, too.

Kudos, Miquel, and thanks bud,

montefin