jump to navigation

Linux sparse file in /var/log/lastlog using RHEL3 19 November 2008

Posted by Maulvi Bakar in : Linux,Work , add a comment

The guys in the promised backup lands had their heads scratching.  Their backups seems to bloat an extra 1.2TB in size!  The culprit seems to be the

/var/log/lastlog

Lastlog is sparse file which contains unallocated blocks or “empty space” and it does not actually take up filesystem space.  Simple test like thus will have a very straightforward results –

$ du -H /var/log/lastlog
156kB   /var/log/lastlog

Furthermore, “lastlog” is a file that almost never grow anyway. A common issue apparently.

Usually it is suggested that either the file be excluded from the backup excercise or, if policy-wise not possible, then the backup application to be configured to handle the specific sparse file, in this case “lastlog”.

Sparse files can confuse some backup software. Usually tools like GNU tar requires the use of the -S parameter to fix it. If you are using some other software, consult the backup software’s manuals for options on how to deal with sparse files.

Enjoy!

π