Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My /var/log/lastlog file is huge. I know it's really only a few kilobytes, but tar isn't smart enough to know that, so when I image a virtual machine, my restore fails because it thinks I'm trying to load more data than I have capacity on my disk.

I want to delete /var/log/lastlog and stop any and all logging to the file. I'm aware of the security implications. This logging needs to stop to preserve my backup strategy.

I've made a change to /etc/pam.d/login which I was told would disable logging to /var/log/lastlog, but it does not appear to work as /var/log/lastlog keeps growing.

# Prints the last login info upon succesful login
# (Replaces the `LASTLOG_ENAB' option from login.defs)
#session    optional

Any ideas?


For anyone interested, I use Centrify Express to authenticate my users via LDAP. Centrify Express is "free", but one of the drawbacks is that I can't manage user UIDs via LDAP, so they are given a dynamic UID when they login to a server. Centrify picks some crazy high UID values (so they don't conflict with local users on the server, presumably). /var/log/lastlog is indexed by UID, and grows to accommodate the largest UID on the system. This means that when a Centrify user logs in, they get a UID in the upper-end of the UID range, which causes lastlog to allocate an obscene amount of space, according to the file system.

~$ ll /var/log/lastlog
-rw-rw-r-- 1 root root 291487675780 Apr 10 16:37 /var/log/lastlog
~$ du -h /var/log/lastlog
20K     /var/log/lastlog

More Into ---> Sparse Files

share|improve this question
Well, definitely there's a way to disable it or limit its size, but I'm not an expert on this. This reminded me though of a hard-fix of mine for this problem on Windows: I would delete the file and create a directory with the name of the file, in that location. :D :) – user127350 Apr 10 '12 at 21:15
I can't figure out how to comment on your question. If you delete /var/log/lastlog, does that work, or does it come back? – user130777 Apr 28 '12 at 0:12
up vote 9 down vote accepted

Try this command:

ln -sfn /dev/null /var/log/lastlog
share|improve this answer
This is cheating. There must be another way. :) – user127350 Apr 10 '12 at 21:31
It's a darn good idea though :). Probably not too hard to automate with puppet either. – GregB Apr 10 '12 at 21:31
This ended up working. I looked in the logs that PAM creates and there is an exception that it can't write to /var/log/lastlog. It turns out that the PAM module will never re-create lastlog if it doesn't exist, so the file can just be deleted. – GregB Apr 30 '12 at 20:06

The best solution here, in my opinion, is to use tar's -S / --sparse option to handle sparse files properly.

share|improve this answer
Unfortunately, tar gets called by a third-party backup service, so I don't have any control over the parameters. I sent a ticket to the third-party telling them the same thing :). – GregB Apr 27 '12 at 18:12

if the 3rd party is using your system tar, rename tar to say, tar.real; then make a script called tar which will use -S only when called by the third-party software.

better, call the third-party via wrapper script which adds a special bin dir to the front of PATH, where you have the wrapper for tar, only works so long as third-party is not using absolute paths.

share|improve this answer
Hi Tepal, thanks for this answer. Given this question already has an accepted answer, could you edit your answer to elaborate a bit on what it is trying to achieve for other folks who may be reading it? – bertieb Jul 6 '15 at 15:07
Wow, bringing this back from the dead. As I recall, the issue was restoring snapshots of Rackspace public cloud servers. I thought I had backups, but restore failed because of the space issues mentioned in the original post. I can't remember if tar ran on the VM, or on another server that streamed the image data to the new VM. – GregB Jul 8 '15 at 15:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .