Home / server / Questions / 1096592
In Process
Nstevens
Asked: 2022-03-21 03:10:48 +0800 CST

why is faillog, tallylog and lastlog so big?

  • 772

I got a notice from a backup system (rsnapshot) today that it's storage volume was full. A closer look reveals some older snapshots where faillog, tallylog and lastlog are bigger than the actual filesystem they are on (/var is a 6G partition).

-rw-r--r--  3 root       root             65G Feb 11 08:33 faillog
-rw-------  3 root       root            129G Feb 11 08:33 tallylog
-rw-rw-r--  2 root       utmp            585G Feb 11 08:57 lastlog

Redhat says this is normal. Any way to limit the size on these? Can they be safely rotated every few hours?

linux syslog systemd

1 Answers

  1. Redhat says this is normal. Any way to limit the size on these? Can they be safely rotated every few hours?

    What RedHat says is that it's a sparse file. That's a file where the length of the file is larger than the content of the file; it has holes what doesn't contain any data.

    To back up sparse files, use a tool that recognizes sparse files and can handle them correctly.

    You should not rotate the files; that won't solve your problem. Rather, you should configure rsnapshot to use the --sparse flag. Or use a better backup tool. Or not back up those files.

    • 0