The /var/log/lastlog file is used to store information about the successful logins to the host. On several versions of RedHat Enterprise Linux and Fedora, corruption in this file can cause the size to be misrepresented. This has no effect on the real space used by the file, as reported by the du command.
To correct the improper file size of the /var/log/lastlog file, it needs to be recreated.
To recreate the lastlog file, run this command:
> /var/log/lastlog
Note: This command deletes any data on the lastlog file.
This command deletes the previous file and removes any record of log in to the system. If you wish to retain this information, use the lastlog command to export the log in information before recreating the /var/log/lastlog file.
lastlog > /tmp/lastlog.txt
The lastlog.txt file can then be saved to a secure location.