The /var/log/lastlog file has very large size on a ESX host

Products

• VMware vSphere ESXi

Issue/Introduction

Symptoms:

• The size of /var/log/lastlog file is very large, to the point of possible being larger than the underlying file system.
  
  [root@esx41vm log]# df -h .
  Filesystem Size Used Avail Use% Mounted on
  /dev/sdc2 2.0G 45M 1.8G 3% /var/log
  [root@esx41vm log]# ls -lh lastlog
  -rw-r--r-- 1 root root 354G Jul 30 09:29 lastlog
  
  
• Using the du command shows the size of the /var/log/lastlog file within normal limits:
  
  [root@esx41vm log]# du -h lastlog
  44K lastlog

Environment

VMware ESX 4.0.x
VMware ESX Server 3.5.x
VMware ESX 4.1.x

Resolution

The /var/log/lastlog file is used to store information about the successful logins to the host. On several versions of RedHat Enterprise Linux and Fedora, corruption in this file can cause the size to be misrepresented. This has no effect on the real space used by the file, as reported by the du command.

To correct the improper file size of the /var/log/lastlog file, it needs to be recreated.

To recreate the lastlog file, run this command:

> /var/log/lastlog

Note: This command deletes any data on the lastlog file.

This command deletes the previous file and removes any record of log in to the system. If you wish to retain this information, use the lastlog command to export the log in information before recreating the /var/log/lastlog file.

lastlog > /tmp/lastlog.txt

The lastlog.txt file can then be saved to a secure location.