Lastlog

lastlog is a command available in most flavors of UNIX based operating systems. It is similar in functionality to the unix command last. However, last parses a different database (wtmp & btmp). The man page for [http://www.die.net/doc/linux/man/man8/lastlog.8.html lastlog] describes it in the following way:

lastlog formats and prints the contents of the last login log /var/log/lastlog file. The login-name, port, and last login time will be printed. The default (no flags) causes lastlog entries to be printed,sorted by their order in /etc/passwd

The lastlog sparse file mystery

System administrators may be confused by the apparent misreporting of the size of lastlog by utilities such as ls. Since lastlog is a sparse file, its reported file size isn't always the size it consumes on the UNIX file system. The [http://www.die.net/doc/linux/man/man8/lastlog.8.html man page for lastlog] explains the confusion:

"The lastlog file is a database which contains info on the last login of each user. You should not rotate it. It is a sparse file, so its size on the disk is usually much smaller than the one shown by "ls -l" (which can indicate a really big file if you have in passwd users with a high UID). You can display its real size with "ls -s". " ( See reference ** below )

In these examples below, you will see that both du and ls report the file as 1.2 TeraBytes, whereas using a different invocation of the command will show the size consumed on the disk:

[root@bogushost] # ls -l lastlog -r-------- 1 root root 1254130450140 Jun 21 19:25 lastlog

[root@bogushost] # ls -lsh lastlog 56K -r-------- 1 root root 1.2T Jun 21 19:25 lastlog

[root@bogushost] # ls -sbh lastlog 56K lastlog

[root@bogushost] # du -sh lastlog 56K lastlog

[root@bogushost] # du -sb lastlog 1254130450140 lastlog

External links

* [http://www.die.net/doc/linux/man/man8/lastlog.8.html lastlog man page]
* [http://pages.cs.wisc.edu/~thain/library/sparse.pdf PDF explanation of sparse files]