7

My /var/log/lastlog file is huge. I know it's really only a few kilobytes, but tar isn't smart enough to know that, so when I image a virtual machine, my restore fails because it thinks I'm trying to load more data than I have capacity on my disk.

I want to delete /var/log/lastlog and stop any and all logging to the file. I'm aware of the security implications. This logging needs to stop to preserve my backup strategy.

I've made a change to /etc/pam.d/login which I was told would disable logging to /var/log/lastlog, but it does not appear to work as /var/log/lastlog keeps growing.

# Prints the last login info upon succesful login
# (Replaces the `LASTLOG_ENAB' option from login.defs)
#session    optional   pam_lastlog.so

Any ideas?

EDIT

For anyone interested, I use Centrify Express to authenticate my users via LDAP. Centrify Express is "free", but one of the drawbacks is that I can't manage user UIDs via LDAP, so they are given a dynamic UID when they login to a server. Centrify picks some crazy high UID values (so they don't conflict with local users on the server, presumably). /var/log/lastlog is indexed by UID, and grows to accommodate the largest UID on the system. This means that when a Centrify user logs in, they get a UID in the upper-end of the UID range, which causes lastlog to allocate an obscene amount of space, according to the file system.

~$ ll /var/log/lastlog
-rw-rw-r-- 1 root root 291487675780 Apr 10 16:37 /var/log/lastlog
~$ du -h /var/log/lastlog
20K     /var/log/lastlog

More Into ---> Sparse Files

3
  • Well, definitely there's a way to disable it or limit its size, but I'm not an expert on this. This reminded me though of a hard-fix of mine for this problem on Windows: I would delete the file and create a directory with the name of the file, in that location. :D :)
    – user127350
    Apr 10, 2012 at 21:15
  • I can't figure out how to comment on your question. If you delete /var/log/lastlog, does that work, or does it come back?
    – user130777
    Apr 28, 2012 at 0:12
  • Here are some links to the bug reports in Redhat / fedora and ubuntu. Hopefully, more people will call attention to this issue and it will get some attention. bugs.launchpad.net/ubuntu/+source/util-linux/+bug/1707645 bugzilla.redhat.com/show_bug.cgi?id=951564
    – nelaaro
    Oct 26, 2018 at 10:13

4 Answers 4

13

Try this command:

ln -sfn /dev/null /var/log/lastlog
3
  • 2
    This is cheating. There must be another way. :)
    – user127350
    Apr 10, 2012 at 21:31
  • 1
    It's a darn good idea though :). Probably not too hard to automate with puppet either.
    – GregB
    Apr 10, 2012 at 21:31
  • 1
    This ended up working. I looked in the logs that PAM creates and there is an exception that it can't write to /var/log/lastlog. It turns out that the PAM module will never re-create lastlog if it doesn't exist, so the file can just be deleted.
    – GregB
    Apr 30, 2012 at 20:06
4

The best solution here, in my opinion, is to use tar's -S / --sparse option to handle sparse files properly.

1
  • 1
    Unfortunately, tar gets called by a third-party backup service, so I don't have any control over the parameters. I sent a ticket to the third-party telling them the same thing :).
    – GregB
    Apr 27, 2012 at 18:12
2

if the 3rd party is using your system tar, rename tar to say, tar.real; then make a script called tar which will use -S only when called by the third-party software.

better, call the third-party via wrapper script which adds a special bin dir to the front of PATH, where you have the wrapper for tar, only works so long as third-party is not using absolute paths.

2
  • Hi Tepal, thanks for this answer. Given this question already has an accepted answer, could you edit your answer to elaborate a bit on what it is trying to achieve for other folks who may be reading it?
    – bertieb
    Jul 6, 2015 at 15:07
  • Wow, bringing this back from the dead. As I recall, the issue was restoring snapshots of Rackspace public cloud servers. I thought I had backups, but restore failed because of the space issues mentioned in the original post. I can't remember if tar ran on the VM, or on another server that streamed the image data to the new VM.
    – GregB
    Jul 8, 2015 at 15:09
1

I'm using Arch linux with systemd. This works for me.

As root:

1. systemctl stop systemd-update-utmp
systemctl disable systemd-update-utmp
systemctl mask systemd-update-utmp

  1. cp /usr/lib/tmpfiles.d/var.conf /etc/tmpfiles.d/

  2. vi or nano /etc/tmpfiles.d/var.conf
    comment out these 3 lines:
    #f /var/log/wtmp 0664 root utmp -
    #f /var/log/btmp 0660 root utmp -
    #f /var/log/lastlog 0664 root utmp -

  3. rm the 3 files in question from /var/log

Done.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .