If you are having disk space problems in /var and you found that /var/log/faillog, /var/log/lastlog and /var/log/tallylog are filling up the space and you need to rotate them, you probably don’t need to rotate them

root@linux:~ # df -h /var/log
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vgroot-lv_var_log
4.9G 2.0G 2.8G 42% /var/log

These are sparse files and are occupying minimal disk space. Keep looking for the offender

root@linux:~ # ls -lh /var/log/faillog
-rw——-. 1 root root 258M Apr 25 14:07 /var/log/faillog

root@linux:~ # du -sh /var/log/faillog
624K /var/log/faillog
root@linux:~ # du -h –apparent-size /var/log/faillog
258M /var/log/faillog

root@linux:~ # ls -lh /var/log/lastlog
-rw——-. 1 root root 2.3G May 2 11:05 /var/log/lastlog

root@linux:~ # du -h /var/log/lastlog
348K /var/log/lastlog
root@linux:~ # du -h –apparent-size /var/log/lastlog
2.3G /var/log/lastlog

root@linux:~ # ls -lh /var/log/tallylog
-rw——-. 1 root root 515M May 2 10:42 /var/log/tallylog

root@linux:~ # du -sh /var/log/tallylog
288K /var/log/tallylog
root@linux:~ # du -sh –apparent-size /var/log/tallylog
515M /var/log/tallylog

Source: faillog command create a huge file, like 128GB file (/var/log/faillog)

Why is the /var/log/lastlog file so large?

• Linux