Lastlog

lastlog is a command available in most flavors of UNIX based operating systems. It is similar in functionality to the unix command last. However, last parses a different database (wtmp & btmp). The man page for lastlog describes it in the following way:

lastlog formats and prints the contents of the last login log /var/log/lastlog file. The login-name, port, and last login time will be printed. The default (no flags) causes lastlog entries to be printed, sorted by their order in /etc/passwd

The lastlog sparse file mystery on SysV UNIX

System administrators may be confused by the apparent misreporting of the size of lastlog by utilities such as ls. Since lastlog is a sparse file, its reported file size isn't always the size it consumes on the UNIX file system. The man page for lastlog explains the confusion:

"The lastlog file is a database which contains info on the last login of each user. You should not rotate it. It is a sparse file, so its size on the disk is usually much smaller than the one shown by "ls -l". You can display its real size with "ls -s". " ( See reference ** below )

In addition, it seems to confuse some backup software. Tivoli Storage Manager, for example, will try to load TeraBytes of tapes to back up this file.^{[citation needed]}

In these examples below, you will see that both du and ls report the file as 1.2 TeraBytes, whereas using a different invocation of the command will show the size consumed on the disk:

[root@bogushost]# ls -l lastlog
-r--------  1 root root 1254130450140 Jun 21 19:25 lastlog

[root@bogushost]# ls -lsh lastlog
56K -r--------  1 root root 1.2T Jun 21 19:25 lastlog

[root@bogushost]# ls -sbh lastlog
56K lastlog

[root@bogushost]# du -sh lastlog
56K     lastlog

[root@bogushost]# du -sb lastlog
1254130450140   lastlog

External links

• lastlog(8) – Linux Administration and Privileged Commands Manual
• PDF explanation of sparse files