Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My /var/log/lastlog file is huge. I know it's really only a few kilobytes, but tar isn't smart enough to know that, so when I image a virtual machine, my restore fails because it thinks I'm trying to load more data than I have capacity on my disk.

I want to delete /var/log/lastlog and stop any and all logging to the file. I'm aware of the security implications. This logging needs to stop to preserve my backup strategy.

I've made a change to /etc/pam.d/login which I was told would disable logging to /var/log/lastlog, but it does not appear to work as /var/log/lastlog keeps growing.

# Prints the last login info upon succesful login
# (Replaces the `LASTLOG_ENAB' option from login.defs)
#session    optional   pam_lastlog.so

Any ideas?

EDIT

For anyone interested, I use Centrify Express to authenticate my users via LDAP. Centrify Express is "free", but one of the drawbacks is that I can't manage user UIDs via LDAP, so they are given a dynamic UID when they login to a server. Centrify picks some crazy high UID values (so they don't conflict with local users on the server, presumably). /var/log/lastlog is indexed by UID, and grows to accommodate the largest UID on the system. This means that when a Centrify user logs in, they get a UID in the upper-end of the UID range, which causes lastlog to allocate an obscene amount of space, according to the file system.

~$ ll /var/log/lastlog
-rw-rw-r-- 1 root root 291487675780 Apr 10 16:37 /var/log/lastlog
~$ du -h /var/log/lastlog
20K     /var/log/lastlog

More Into ---> Sparse Files

share|improve this question
    
Well, definitely there's a way to disable it or limit its size, but I'm not an expert on this. This reminded me though of a hard-fix of mine for this problem on Windows: I would delete the file and create a directory with the name of the file, in that location. :D :) –  Radoo Apr 10 '12 at 21:15
    
I can't figure out how to comment on your question. If you delete /var/log/lastlog, does that work, or does it come back? –  user130777 Apr 28 '12 at 0:12
add comment

2 Answers 2

up vote 9 down vote accepted

Try this command:

ln -sfn /dev/null /var/log/lastlog
share|improve this answer
1  
This is cheating. There must be another way. :) –  Radoo Apr 10 '12 at 21:31
    
It's a darn good idea though :). Probably not too hard to automate with puppet either. –  GregB Apr 10 '12 at 21:31
    
This ended up working. I looked in the logs that PAM creates and there is an exception that it can't write to /var/log/lastlog. It turns out that the PAM module will never re-create lastlog if it doesn't exist, so the file can just be deleted. –  GregB Apr 30 '12 at 20:06
add comment

The best solution here, in my opinion, is to use tar's -S / --sparse option to handle sparse files properly.

share|improve this answer
    
Unfortunately, tar gets called by a third-party backup service, so I don't have any control over the parameters. I sent a ticket to the third-party telling them the same thing :). –  GregB Apr 27 '12 at 18:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.