why is faillog, tallylog and lastlog so big?

Nstevens

7/20/23, 11:10 AM

I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual filesystem they are on (/var is a 6G partition).

-rw-r--r--  3 root       root             65G Feb 11 08:33 faillog
-rw-------  3 root       root            129G Feb 11 08:33 tallylog
-rw-rw-r--  2 root       utmp            585G Feb 11 08:57 lastlog

Redhat says this is normal. Any way to limit the size on these? Can they be safely rotated every few hours?

180

0 + 0

linux

syslog

systemd

user10489

7/20/23, 2:02 PM

Use `du` or `ls -s` to determine actual file size. The number shown by `ls -l` is not the file size, but the file length, which don't match for sparse files.

Nstevens

7/22/23, 2:17 PM

What? That makes absolutely no sense. `-l` is the short for `listing` format.

user10489

7/22/23, 10:09 PM

I always thought `ls -l` was "long format" not listing format, and the man page agrees. You could use `ls -ls` and get both size and length at once.

Score:0

Server

vidarlo

7/20/23, 11:38 AM

Redhat says this is normal. Any way to limit the size on these? Can they be safely rotated every few hours?

What RedHat says is that it's a sparse file. That's a file where the length of the file is larger than the content of the file; it has holes what doesn't contain any data.

To back up sparse files, use a tool that recognizes sparse files and can handle them correctly.

You should not rotate the files; that won't solve your problem. Rather, you should configure rsnapshot to use the --sparse flag. Or use a better backup tool. Or not back up those files.

0 + 0

Nstevens

7/22/23, 2:18 PM

Thanks for the tip on the `--sparse` flag. I'll give it a shot.