lastlog is a program available in most flavors of UNIX based operating systems. It is similar in functionality to the unix program last. However, last parses a different database (wtmp and btmp).
lastlog formats and prints the contents of the last login log file, /var/log/lastlog, including the login name, port, and last login datetime.
The lastlog sparse file mystery on SysV UNIX
System administrators may be confused by the apparent misreporting of the size of lastlog by utilities such as ls. Since lastlog is a sparse file, its reported file size isn't always the size it consumes on the UNIX file system. The man page for lastlog explains the confusion:
"The lastlog file is a database which contains info on the last login of each user. You should not rotate it. It is a sparse file, so its size on the disk is usually much smaller than the one shown by "ls -l". You can display its real size with "ls -s". " ( See reference ** below )
In addition, it seems to confuse some backup software. Tivoli Storage Manager, for example, will try to load TeraBytes of tapes to back up this file.
In these examples below, you will see that both du and ls report the file as 1.2 TeraBytes, whereas using a different invocation of the command will show the size consumed on the disk:
[root@bogushost]# ls -l lastlog -r-------- 1 root root 1254130450140 Jun 21 19:25 lastlog [root@bogushost]# ls -lsh lastlog 56K -r-------- 1 root root 1.2T Jun 21 19:25 lastlog [root@bogushost]# ls -sbh lastlog 56K lastlog [root@bogushost]# du -sh lastlog 56K lastlog [root@bogushost]# du -sb lastlog 1254130450140 lastlog