Lastlog Question..

[Eric Eisenhart]

On Wed, Aug 14, 2002 at 05:43:40PM -0700, Christopher Wagner wrote:
> On one of my computers, my /var/log/lastlog is approaching 20 meg..  Is this
> normal?  Should this be part of normal log rotation?  What's the safest way
> to get this back to a reasonable size?  Thanks folks!

It should be rotated by logrotate about once a month.

It depends on how many users you have.

Actually, I think it might depend more on what the highest uid# in your
passwd database is.

It should, I think, be reasonably safe to rotate it yearly via logrotate or
to do it manually; something like:

cd /var/log
touch lastlog.new
chown --reference=lastlog lastlog.new
chmod --reference=lastlog lastlog.new
ln lastlog lastlog.1
mv lastlog.new lastlog

(yes, that seems complicated and weird; it's all about atomic operations so
there's never a point at which there isn't either the old lastlog file or
the new lastlog file in place; it's related to last night's discussion about
database transactions: with filesystem transactions that would be
"transaction start ; mv lastlog lastlog.1 ; touch lastlog ; chown
--reference=lastlog.1 lastlog; chmod reference=lastlog.1 lastlog ;
transaction commit", which is, actually, no less complicated, really)
-- 
Eric Eisenhart                                  eric-dot-sig at eisenhart.com
Perl, SQL, Linux and Web            ^           IRC: Freiheit at openprojects
Coder, Sysadmin and geek           /e\                AIM: falsch freiheit
http://eric.eisenhart.com/         ---                       ICQ: 48217244