/var/log/lastlog is what's called a "sparse file". Like a plain file
on disk, it consists of a sequentially numbered array of bytes, but unlike
a plain file, not all the bytes are filled with data.  Unused portions of
a plain file are filled with default data.  Unused "holes" in a sparse
file are not even filled with default data; they're simply not stored on
disk.  I believe the large uid of nfsnobody means that adding data about
it to lastlog creates a huge hole for non-existent smaller uid's. To see
how much space is actually taken on disk, use "du" instead of "ls".  To
get the disk space in bytes taken by lastlog:
 du -b /var/log/lastlog

Steven Yellin

On Sun, 16 Oct 2005, Stefan Sabolowitsch wrote:

> Hi List,
>
>
>
> File /var/log/lastlog very big 1.3 GB, possible a Bug in SL 4.1 X86_64
> Version
>
>
>
> The following connection found.
>
>
>
> If UID / GID is too high becomes lastlog very largely.
>
>
>
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=61983
>
>
>
> The user nfsnobody looks with X SL 4.1 X86_64 in such a way.
>
>
>
> nfsnobody:x:4294967294:4294967294:Anonymous NFS
> User:/var/lib/nfs:/sbin/nologin
>
>
>
> and with SL 4.0 X86
>
>
>
> nfsnobody:x: 65534:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
>
>
>
> I deleted and again generated lastlog. It is now ca. 100KB largely.
>
>
>
> Can someone confirm this problem?
>
>
>
>
>
> Stefan Sabolowitsch
>
>
>
>
>
>
>
>