system with high numbered uids has huge sparse /var/log/lastlog

[Jamie Strandboge]

I was investigating the use of a single high UID user (ie, 2000000000) and discovered that /var/log/lastlog grew to an enormously large sparse file:

$ ls -lh /var/log/lastlog
-rw-rw-r-- 1 root utmp 544G Jul 27 12:35 /var/log/lastlog

The file is actually quite small though:
$ ls -lh --size /var/log/lastlog
56K -rw-rw-r-- 1 root utmp 544G Jul 27 12:35 /var/log/lastlog

On a standalone system, this is possibly not a problem since it is highly unlikely that a system will have 2 billion users, but this is confirmed to wreak havoc on rsync backups.

[Jamie Strandboge (jdstrand)]

FYI, people using rsync for backups might be interested in the --sparse (-S) option.

[Steve Langasek (vorlon)]

I don't see what we can be expected to do with this bug report. This is the defined file format for /var/log/lastlog.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[aaron (nelaaro)]

Someone needs to take on all the affected systems, PAM, users etc to find a fix.

In redhat this has been an open issue since 2013. If anybody sees this hopefully it will direct interested parties to places where other people are talking about the same issue.

This also becomes an issue in Docker containers, where user IDs are large.
Great way to fill up your docker image with junk.

https://bugzilla.redhat.com/show_bug.cgi?id=951564

[Oliver O'Boyle (ooboyle)]

This is affecting Ubuntu 20.04 with sssd integration to AD. I am seeing massive lastlog files because of what appears to be the use of very high UID's being assigned to AD users when they log in.

-rw-rw-r-- 1 root utmp 88943346292 Jan 6 16:50 lastlog

Oliver

[Seth Arnold (seth-arnold)]

Oliver, from the lastlog(8) manpage:

       The lastlog file is a database which contains info on the
       last login of each user. You should not rotate it. It is a
       sparse file, so its size on the disk is usually much smaller
       than the one shown by "ls -l" (which can indicate a really
       big file if you have in passwd users with a high UID). You
       can display its real size with "ls -s".

http://manpages.ubuntu.com/manpages/focal/man8/lastlog.8.html

If you're using a filesystem that can't handle sparse files it might be best to not use lastlog.

Thanks