huge lastlog, faillog and tallylog on linux ?

If you have huge UID numbers in your name space, you will see some huge files in your /var/log area on Redhat.

$ id
uid=994295558(venkat) gid=50000(admin)context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
$ ls -ls /var/log|awk ' $1*4096 < $6'
8 -rw-r--r--. 1 root root 290334301184 Nov 14 13:32 lastlog
24 -rw-------. 1 root root 63634915328 Nov 14 11:41 tallylog

These are sparse files, not taking up disk space ( see first column of above ls output). This behavior is due to the (old) way of indexing used by lastlog formatting. But could cause issues for backup applications - which are not sparse file aware. Backups might take forever to complete and take up 100% cpu while seeking these huge files


There is no fix in either RHEL6 or 7, other than fixing larger UID's :(

For the curios, here with bugzilla info rhel6 fedora