Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My /var/log/lastlog file is huge. I know it's really only a few kilobytes, but tar isn't smart enough to know that, so when I image a virtual machine, my restore fails because it thinks I'm trying to load more data than I have capacity on my disk.

I want to delete /var/log/lastlog and stop any and all logging to the file. I'm aware of the security implications. This logging needs to stop to preserve my backup strategy.

I've made a change to /etc/pam.d/login which I was told would disable logging to /var/log/lastlog, but it does not appear to work as /var/log/lastlog keeps growing.

# Prints the last login info upon succesful login
# (Replaces the `LASTLOG_ENAB' option from login.defs)
#session    optional

Any ideas?


For anyone interested, I use Centrify Express to authenticate my users via LDAP. Centrify Express is "free", but one of the drawbacks is that I can't manage user UIDs via LDAP, so they are given a dynamic UID when they login to a server. Centrify picks some crazy high UID values (so they don't conflict with local users on the server, presumably). /var/log/lastlog is indexed by UID, and grows to accommodate the largest UID on the system. This means that when a Centrify user logs in, they get a UID in the upper-end of the UID range, which causes lastlog to allocate an obscene amount of space, according to the file system.

~$ ll /var/log/lastlog
-rw-rw-r-- 1 root root 291487675780 Apr 10 16:37 /var/log/lastlog
~$ du -h /var/log/lastlog
20K     /var/log/lastlog

More Into ---> Sparse Files

share|improve this question
Well, definitely there's a way to disable it or limit its size, but I'm not an expert on this. This reminded me though of a hard-fix of mine for this problem on Windows: I would delete the file and create a directory with the name of the file, in that location. :D :) – Radoo Apr 10 '12 at 21:15
I can't figure out how to comment on your question. If you delete /var/log/lastlog, does that work, or does it come back? – user130777 Apr 28 '12 at 0:12
up vote 9 down vote accepted

Try this command:

ln -sfn /dev/null /var/log/lastlog
share|improve this answer
This is cheating. There must be another way. :) – Radoo Apr 10 '12 at 21:31
It's a darn good idea though :). Probably not too hard to automate with puppet either. – GregB Apr 10 '12 at 21:31
This ended up working. I looked in the logs that PAM creates and there is an exception that it can't write to /var/log/lastlog. It turns out that the PAM module will never re-create lastlog if it doesn't exist, so the file can just be deleted. – GregB Apr 30 '12 at 20:06

The best solution here, in my opinion, is to use tar's -S / --sparse option to handle sparse files properly.

share|improve this answer
Unfortunately, tar gets called by a third-party backup service, so I don't have any control over the parameters. I sent a ticket to the third-party telling them the same thing :). – GregB Apr 27 '12 at 18:12

if the 3rd party is using your system tar, rename tar to say, tar.real; then make a script called tar which will use -S only when called by the third-party software.

better, call the third-party via wrapper script which adds a special bin dir to the front of PATH, where you have the wrapper for tar, only works so long as third-party is not using absolute paths.

share|improve this answer
Hi Tepal, thanks for this answer. Given this question already has an accepted answer, could you edit your answer to elaborate a bit on what it is trying to achieve for other folks who may be reading it? – bertieb Jul 6 '15 at 15:07
Wow, bringing this back from the dead. As I recall, the issue was restoring snapshots of Rackspace public cloud servers. I thought I had backups, but restore failed because of the space issues mentioned in the original post. I can't remember if tar ran on the VM, or on another server that streamed the image data to the new VM. – GregB Jul 8 '15 at 15:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.